In this edition of the OSINT Insider, we will look at an OSINT company that provides more accurate results than FaceCheck or Pimeyes, ways in which the Com can bypass KYC security checks, and discuss a way to scrape subscriber information held by an Australian broadband provider. Additionally, we will cover ways in which investigators can find out more information on a shell company, even when they encounter a registered agent and new OPSEC risks.

The free version of this edition will cover:

• OSINT Industries Launched a Massive Spring Update to Improve Workflow

• Discord.id says “Screw Them Anyway” When Discord Takes Action Against it

• Impressive Facial Recognition Tool that Detects Faces in Obscure Images And Returns More Results Than FaceCheck or Pimeyes

• Sending Instagram URLs Can Compromise Your Anonymity and OPSEC

• How Subscriber Information Held by an Australian Government-Owned Broadband Provider Could Be Scrapped

Because each issue requires a significant amount of time and effort for research and writing, access to the full edition is available to paid subscribers only.

The full edition includes The Com Corner section and covers the points mentioned above, as well as:

• A Major OPSEC Alert Regarding Tile – The App That Potentially Facilitates Stalking by Compromising Your Geolocation Data

• New SOCMINT Video Search Engine for Different Platforms

• Ways to Pivot When You Find a Shell Company or Registered Agent in Company or Individual Due Diligence

• Tool that Grants Access to a Database of Every Politician Worldwide

• New Rival to Holehe and a Free OSINT Industries Alternative

• A New GPSjam Alternative that Allows to Detect GPS Interferences in Real Time

• Bellingcat’s New Flight Tracking Tool that Uncovers Important Patterns in Flight Data

• New Historical Database of Various Cybercrime Forum Usernames

• New TikTok Comment History and Keyword Search Tools with Effective Filters and Massive Databases of Archived Content

• ACLED Launches ACLED Trends – a Tool that Helps to Anticipate Political Instability Worldwide Before Violence Erupts

• Database on Armed Conflict, Civil War, and Organized Violence with Global Coverage

• Tool that Allows to Identify Vulnerable Access Point Devices Worldwide

• New Metadata Extraction and Geolocation Analysis Tool With an Impressive Investigation Potential

• India Document Search Engine that Provides Access to Court Documents

• Google Fact Check Tools that Support Search in Multiple Languages

• Automated Dorking Tool that Scrapes File URLs

• New Tool that Tracks Changes in The Amount of Nighttime Light to Provide Insight into the Likely Geopolitical Situation on the Ground, to be Used in Investigative Research

The Com Corner Section looks at the following:

• How The Com Bypasses KYC Security Checks

• [Redacted] Announces the Addition of a Person Search and IntelX Stealer Log Export Tools and Introduces a “Legitimate” Threat Intelligence Service Which Claims to Rival Flare.io

• New Illicit Tool that Provides Access to PII via Signal

Previous Edition:

In the previous edition of the OSINT Insider, we exposed the criminal side of an Illicit OSINT Marketplace and covered some of the unethical OSINT tools that provided unauthorized access to highly sensitive personal information and bank details. Specifically, we discussed a potentially Nazi-owned US lookup tool and an illicit UK lookup tool that provided rare PII data. Read more here.

OSINT News

📌 OSINT Industries Launched a Massive Spring Update to Improve Workflow

OSINT Industries expanded their At-a-glance Intelligence panel, which summarizes key results related to the digital footprint being investigated, including usernames and names, locations, first and last activity, and sources scanned. This feature aims to facilitate faster analysis of large amounts of data and deliver actionable intelligence.

The Filter and Selection panels have also been redesigned, allowing investigators to better organize their workflow and reduce noise in their reports through the use of more advanced and targeted filters. There is now also an option to export only selected or filtered results in various formats, including PDF+, PDF, DOCX, and CSV.

Users can also take notes that are included in PDF reports, helping them organize their thoughts, leave reminders, and add relevant insights or context directly within the report.

Besides that, the Hint Composer tool has been temporarily removed from the platform because it was confusing to use, until a more intuitive alternative that is easier to work with is developed. A “Jump to Section” feature has also been added to save time when navigating through results.

https://app.osint.industries/

📌 Discord.id says “Screw Them Anyway” When Discord Takes Action Against it

Discord is taking action against Discord.id as part of its crackdown on OSINT tools that enable unauthorized data scraping and user tracking.

Discord.id works by using a Discord user snowflake to pull the profile information on the Discord user. However, it has been announced on the tool’s website that Discord started to terminate bots and users that provided tokens to enable the lookups. This means that if the tool is used, you will need to provide your own bot tokens and store them in your browser, which is risky.

https://discord.id/

Advertisement/Promotion

Panoptica

Panoptica Technologies, a company backed by Georgia Tech, develops autonomous agents to accelerate tactical-level intelligence and OSINT workflows by leveraging automated reasoning. The platform replaces legacy, time-consuming, and labor intensive workflows so that analysts get to do more of the things they do best: analysis. Panoptica enables organizations to identify adversary networks, forecast activity, and accelerate intelligence-driven decision making in national security and law enforcement contexts so that key stakeholders are able to make decisive decisions in high-stakes environments.

The future of agentic intelligence is here. Sign up for a free demo today

📌 Impressive Facial Recognition Tool that Detects Faces in Obscure Images And Returns More Accurate Results Than FaceCheck or Pimeyes

Eyematch.ai is a relatively unheard-of AI-driven facial recognition tool that launched a year or so ago and performs advanced face image search by comparing facial features from the uploaded photo – nose, eyes, and mouth – to detect faces online that display the most similarity to the original image. It can also detect and analyze faces even when lighting, angles, or expressions are different.

When we tested the tool, it was able to detect a matching face in obscure YouTube thumbnails and old videos. It is likely that Eyematch.ai has a much larger database of scrapped content than FaceCheck or Pimeyes, given the volume of results, as a better algorithm is unlikely to be able to produce this many additional results.

While researching Eyematch.ai we noticed that Lenso.ai appears to use its facial recognition results, which turned out to be effectively the same for the test searches that we ran for Lenso.ai and Eyematch.ai. We also discovered that in Lenso.ai’s Terms of Service they state that all people’s search results are sent to Eyematch Ltd, which is the same company as the one behind Eyematch.ai. Also, both platforms require users to give their consent to EyeMatch AI PTE.

Yet, Eyematch.ai is cheaper than Lenso.ai since users get 40 searches per day on Eyematch.ai, as opposed to 50 per month on Lenso.ai.

When comparing results returned by Lenso.ai and Eyematch.ai we found that EyeMatch produces more results and includes more broad or lower confidence results, which is useful as it provides additional context to the investigation and equips the researcher with more information.

The platform allows users to identify any potential privacy or image copyright breach such as misuse of your photos and where your photos are shared, in addition to being useful for investigative professionals.

https://eyematch.ai/

📌 Sending Instagram URLs Can Compromise Your Anonymity and OPSEC

Epieos discovered that every time you share a link to an Instagram post, an IGSH tracking parameter is automatically embedded in the URL. This identifier could be linked to your profile, which means that your account may be exposed when someone opens the link in a browser. This may compromise your OPSEC when the viewer is prompted to follow you.

For this reason, it is recommended that you remove the IGSH string at the end of the URL before sharing any links.

H/T 🎩 Epieos on LinkedIn

https://www.linkedin.com/posts/epieos_stop-sharing-instagram-links-activity-7427709039540871169-M5uw/

Advertisement/Promotion

infostealers.info

Infostealer data is the new breach data, but much worse, billions of highly sensitive credentials and records are available online to anyone with internet access. Threat actors are wreaking havoc using illicit infostealer platforms, and meanwhile most businesses that the market relies on to help catch problems like this early can’t afford the solutions needed to defend people and companies at scale from infostealers, so we produced infostealers.info, a solution for executive protection firms, pentesters, bounter hunters, auditers, and other people and businesses who take data like this and use it to protect people, investigate crimes, and prevent cybercrime, fraud, etc. The cost is low per search, and KYC is required for any access to any uncensored data to protect the data from misuse.

Sign up for infostealers.info today and get 3 free demo searches before committing to purchasing credits and completing our KYC process.

📌 How Subscriber Information Held by an Australian Government-Owned Broadband Provider Could Be Scrapped

Foilmanhacks on X (formerly Twitter) discovered a way to obtain subscriber information on broadband customers in Australia by pulling data from The National Broadband Network (NBN), which is Australia’s government-owned, open-access data network that provides broadband across the country.

Example of the data you can get:

{

“type”: “nbn”,

“technology”: “Satellite”,

“serviceClass”: 8,

“isServiceable”: false,

“newDevelopmentChargeApplies”: false,

“newDevelopmentChargeAmount”: 300,

“newConnectionChargeApplies”: false,

“newConnectionChargeAmount”: 0,

“speedPotential”: {

“downloadSpeed”: 100,

“uploadSpeed”: 20

},

“broadbandPlans”: [],

“blacklistedAddress”: false,

“lastUpdated”: “2026-03-09T10:20:22.000000Z”,

“ntds”: [],

“copperPairs”: [],

“requiresNtdQuestion”: false,

“alternateTechnology”: “”,

“forecastRTC”: null,

“hasFibreUpgrade”: false,

“highSpeedNtdPlansAvailable”: false,

“hasHighSpeedNtdUpgrade”: false,

“offersSelfInstallKit”: false,

“poiData”: null,

“hasComplexInstall”: false

}

{

“timestamp”:1769491595079,

“servingArea”:{

“csaId”:”CSA200000010939”,

“techType”:”FTTN”,

“serviceType”:”Fixed line”,

“serviceStatus”:”available”,

“serviceCategory”:”brownfields”,

“rfsMessage”:”May 2016”,

“description”:”Wollongong”

},

“addressDetail”:{

“id”:”LOC000188168203”,

“latitude”:-34.40681139,

“longitude”:150.8791513,

“reasonCode”:”FTTN_CT”,

“altReasonCode”:”FTTP_NA”,

“techChangeStatus”:”In Design”,

“programType”:”Customer-initiated N2P MDU Complex”,

“targetEligibilityQuarter”:”Jun 2028”,

“previousTechChangeStatus”:”Planned”,

“techFlip”:”“,

“serviceType”:”Fixed line”,

“serviceStatus”:”available”,

“mduFibreEligibility”:false,

“techType”:”FTTN”,

“formattedAddress”:”BLDG 67 100 NORTHFIELDS AV WOLLONGONG NSW 2500 Australia”,

“address1”:”Bldg 67 100 Northfields Av”,

“address2”:”Wollongong NSW 2500 Australia”,

“locality”:”Wollongong”,

“statusMessage”:”connected-true”,

“frustrated”:false,

“zeroBuildCost”:true,

“speedTierAvailability”:true,

“eec”:1,

“coatChangeReason”:”“,

“mpsid”:”2WLG-06-00-MPS-600”,

“cbdpricing”:true,

“ee”:true,

“TC2SMD”:true

}

}

{

“timestamp”:1769491595079,

“servingArea”:{

“csaId”:”CSA200000010939”,

“techType”:”FTTN”,

“serviceType”:”Fixed line”,

“serviceStatus”:”available”,

“serviceCategory”:”brownfields”,

“rfsMessage”:”May 2016”,

“description”:”Wollongong”

},

“addressDetail”:{

“id”:”LOC000188168203”,

“latitude”:-34.40681139,

“longitude”:150.8791513,

“reasonCode”:”FTTN_CT”,

“altReasonCode”:”FTTP_NA”,

“techChangeStatus”:”In Design”,

“programType”:”Customer-initiated N2P MDU Complex”,

“targetEligibilityQuarter”:”Jun 2028”,

“previousTechChangeStatus”:”Planned”,

“techFlip”:”“,

“serviceType”:”Fixed line”,

“serviceStatus”:”available”,

“mduFibreEligibility”:false,

“techType”:”FTTN”,

“formattedAddress”:”BLDG 67 100 NORTHFIELDS AV WOLLONGONG NSW 2500 Australia”,

“address1”:”Bldg 67 100 Northfields Av”,

“address2”:”Wollongong NSW 2500 Australia”,

“locality”:”Wollongong”,

“statusMessage”:”connected-true”,

“frustrated”:false,

“zeroBuildCost”:true,

“speedTierAvailability”:true,

“eec”:1,

“coatChangeReason”:”“,

“mpsid”:”2WLG-06-00-MPS-600”,

“cbdpricing”:true,

“ee”:true,

“TC2SMD”:true

}

}

Some fields include interesting details, such as ”frustrated”, which could potentially be a field to label customers who customer service representatives found were frustrated, angry, etc.

Internals of buildings might also be worth querying to see how different rooms are labeled using the LOCIDs, which could potentially reveal sensitive locations of network equipment.

For a detailed breakdown and step-by-step guide to reproducing this, please become a paid subscriber.

Because each issue requires substantial time for in-depth research, analysis, and writing, the rest of the post is available to paid subscribers only:

Subscribe now

Read more

Despite how dire things may have seemed from the announcement in our last post, Issue #8, The OSINT Insider isn’t going anywhere! Thanks to the generous contributions of our subscribers and the exciting news of our first few official sponsorships, we can now afford to bring on our first staff member and keep the newsletter going.

Please welcome Sofiia M. as the new writer for the OSINT Insider. Sofiia wrote the last edition of the OSINT Insider, and it turned out to be one of the most impressive editions of the newsletter released so far. Given that, she has been chosen as the new writer for the newsletter, while Aidan Raney will still primarily handle all research efforts.

There will be no changes in the content or quality of the newsletter; in fact, you may notice an uptick in quality in certain areas as there are now additional people to assist. Sofiia is a great writer and researcher, and she does an excellent job faithfully creating the newsletter to the degree of quality our readers have come to expect.

The most important improvement that comes with this change will be improved cadence. With the additional help, the newsletter will be able to release on a much more consistent monthly cadence. It may take a few months to get to a perfect monthly cadence, but there should be a large noticeable difference in the consistency of releases almost immediately.

If you want to join the other pioneering subscribers who are supporting us and grant us the resources we need to continue our in-depth research and coverage of the world of OSINT, please become a paid subscriber:

Subscribe now

If you own an OSINT company or product, and want to support the OSINT Insider while advertising to an active audience of OSINT professionals and investigative professionals, please send us a message on Substack or email: sponsorships@osintinsider.com

If you ever have any OSINT tools, resources, methods, etc., you want to share with the newsletter, send them to: editor@osintinsider.com

In this edition of the OSINT Insider, we will expose the sale of breaches and IntelX keys on a new secret OSINT Marketplace, introduce a new regular section covering illicit OSINT tools that provide access to privileged information, discuss a UK Lookup tool that provides access to sensitive financial information, and look at new unique data sources, including an EU Public Database, a tool that allows you to see whether you’ve been searched on Flock, and an illicit tool that still seems to have access to protected CNAM records.

The free version of this edition will cover:

• Flock Surveillance Images Are Now Public Records, An Exciting Precedent for OSINT Investigations

• Caller ID APIs Are Down and No Longer Available in The US and Canada As The Governments Restrict Access to Personal Information

• OSINT Industries Introduces New Advanced Filters, Making Search More Precise and Less Time-Consuming

This full edition includes the new Com Corner section (more on that below) and covers the points mentioned above, as well as:

• Marketplace Expose, Including Illicit/Cybercrime Infostealer Data Lookup Services, IntelX Keys, Custom Modules, and Breaches for Sale

• GEOINT Tool that Returns More Accurate Results than Picarta API

• Up-to-date Country-Specific OSINT Resource Toolkits: Osint-for-Countries-V2.0 and Unishka

• New Tool For Private Investigators in the Field that Addresses Common Issues

• Telegram Tool that Decodes Messages Where a User Used the Spoiler Feature

• Tool that Analyzes ALPR Camera Coverage in the USA by County

• FOIA Request Library for France

• EU Public Database that Allows You To Potentially Correlate Discord User IDs with SORs Reports Associated with Them

• GitHub Repo that Provides Historical Records of China-Based X Accounts

• Skyfall-GS – the Latest Example of a Fascinating Rendering Technique Using 3D Gaussian Splatting

• New Tool that Shows Whether and Who Has Searched Your License Plate on Flock

• New PimEyes AI Report Implementation that Provides Surface-level Results

• New Tool that Can Soon Rival Human-Written Reports, and which Aids in OSINT Collection

• r00m101 Reddit Tool Added New Exciting Features and Now Has a New Name!

• SIGINT Tool that Allows You to Track Vehicles Transmitting APRS in Real Time

• New Tool for Name Lookups on Breach Forums

• New Tool that Enables Centralized Search Across Social Communities on Multiple Platforms

Introducing the Com Corner:

The goal of The OSINT Insider is to keep you updated on everything happening in the world of OSINT, both good and bad. Unfortunately, there is a lot going on in the illicit world, which is why we are announcing the addition of a new regular section to The OSINT Insider - The Com Corner. This section will report on The OSINT Com and the tools its members use.

The Com Corner will discuss unethical OSINT tools and offer a glimpse into the toolbox of a member of The Com. Celebrities and high-profile OSINT investigators are often targeted for swatting, SIM swapping, EDRs, and doxxing - cybercrimes frequently facilitated by this notorious online community. By shedding light on this dark side of OSINT and The Com’s modus operandi, we aim to raise awareness of these risks and help individuals better protect themselves and their privacy from threats such as EDRs, SIM swapping, unauthorized access to regulated data, etc. By developing a deeper understanding of The Com’s culture and methods, professionals will be better equipped to recognize the threat and respond effectively.

The Com Corner section in this edition will cover the following topics. Please note that the unredacted tool names are available in the paid portion of the newsletter:

• [Redacted Tool Name] Receives a Subpoena, [Redacted Tool Name] Also Claims To Be Potentially Targeted by The FBI

• [Redacted Tool Name] Tries to Become a White Hat Tool, Goes Terribly

• A New Alternative to [Redacted Tool Name]?

• [Redacted Tool Name] – Another Infostealer Tool Providing Access to Passwords and Cookies

• Com Data Provider That Claims To Be Superior To [Redacted Tool Name]

• [Redacted Tool Name] Grows Its Empire With The Acquisition [Redacted Tool Name]

• Discord Lookup Tool that Utilizes DSA Sanction Data

• US Lookup Service Launched by [Redacted Tool Name] that Sources Data From The Credit Industry and Retrieves Information About Employment, Debts, etc.

• Com OSINT Tools that Potentially Enable Cybercrime, Including Potentially GLBA-Violating US Lookup Service, TLO, and CNAM Tools

• Com Tool with a Nazi Owner Openly Advertised for Swatting

• UK Lookup Tool that Contains Rare PII Data, Including Regulated Bank Account and Credit Information

• Potential Competitor to [Redacted Tool Name]

Important Announcement About the Future of the OSINT Insider:

You may have noticed this edition took a long time to come out. This is because the only person working on this newsletter up until now (Aidan Raney) cannot sustain the amount of work needed to produce it on a consistent and timely basis. Preparing the newsletter in its current form and scope requires hundreds of hours of labor, its quite a bit more than just writing. We test new tools, investigate data sources, and monitor hundreds of sources to find anything important to our readers, so you don’t have to. We monitor nearly every newsletter, social media account, subreddit, Discord server, Telegram channel, blog, etc related to OSINT. One person doing this in their free time simply isn’t enough to sustain this level of work anymore, especially on a monthly release cadence.

If the newsletter is to continue to exist and have a consistent cadence, we need part-time staff or freelancers to assist, but currently, the newsletter does not make enough to sustain such expenses. Because of this, while the newsletter is unlikely to go away completely, if we cannot secure enough paid subscribers, the newsletter’s scope will likely have to decrease significantly to reduce the amount of labor required while maintaining the cadence that we originally promised (once per month). This edition contains over 30 topics, with in-depth research on every single one; that level of depth simply isn’t sustainable without additional help.

While we would love to continue freely sharing all of the amazing research we do, as we did in the previous edition, because each edition requires a significant amount of labor, moving forward, access to the full edition will be available to paid subscribers only. Free subscribers can still access a handful of free posts in the free section of each edition, and Substack offers a free one-time copy of the paid edition if you are unsure of whether it’s worth it.

We’ve also added a founding subscriber plan for readers who can afford to support the newsletter in a more significant way. A few people have already subscribed to this plan, and we can’t thank them enough. It’s subscribers like these and their generous support that will keep this newsletter running for a long time.

Free subscribers can claim a one-time free trial copy of this edition, courtesy of the OSINT Insider, or upgrade their subscription to The OSINT Insider at the end of this free section. If you aren’t already subscribed, please do so:

Subscribe now

Previous Edition:

In the previous edition of the OSINT Insider, we dived deep into the world of underground OSINT, introducing tools that scrape dating apps and Discord to assist with cold cases and infidelity investigations, and exploring alternatives to the O’Reilly API. We also discussed the usefulness of OSINT tools for tackling human trafficking and looked at changes coming to the US OSINT Community. Read more here.

OSINT News

📌 Flock Surveillance Images Are Now Public Records, An Exciting Precedent for OSINT Investigations

In November 2025, a judge in Washington ruled that images taken by Flock’s automated license plate reader (ALPR) cameras, located in cities such as Stanwood and Sedro-Wooley, qualify as public records under Washington’s Public Records Act and should not be exempt from disclosure upon request.

The fact that time- and location-stamped images of cars captured by ALPR cameras can be requested through standard public records requests means that these photos can be used to track a vehicle’s movements and identify the location where it was last seen, which is likely to prove useful for vehicle OSINT investigations within Washington’s jurisdiction.

Flock ALPR camera

📌 Caller ID APIs Are Down and No Longer Available in The US and Canada As The Governments Restrict Access to Personal Information
CNAM data, which websites such as Seven and CallerIdtest used to provide when querying unknown numbers, has been reported to be inaccessible. SS7 is a set of telecommunication signaling protocols used by phone networks to establish and manage calls and messaging services, and before the access to it was restricted, OSINT investigators could use SS7 signaling data to retrieve caller name information tied to an unknowing number sourced from CNAM records. However, now even large companies are restricted in their access to personal information through CNAM records. In fact, CallerIdtest is now shut down, which they claim is related to the restrictions introduced by the Daniel Anderl Judicial Security and Privacy Act, commonly known as “Daniel’s Law,” which aims to protect the personal information of certain New Jersey public officials, including phone numbers, from public disclosure.

A similar process is happening in Canada, where the Canadian Local Number Portability Consortium (CLNPC) has tightened rules around caller ID lookups and prohibited the use of NPAC data for “publicly available telephone lookup services.” To access Canadian NPAC databases, non-members have to apply for authorized access, demonstrate a legitimate need, and show that they will be seeking consent from end recipients as part of their service.

Advertisement/Promotion

infostealers.info

🔗 URL: https://infostealers.info/invite/712CAE1F

🛡️ Defanged: [https://infostealers[.]info/invite/712CAE1F]

• Summary: Infostealer data is the new breach data, billions of records publicly accessible online to anyone with internet access. Just like breached data, the data was originally sourced by malicious actors, who then leaked it online, making it accessible to anyone with an internet connection, providing an opportunity for investigators to responsibly use this data for their investigations.

  And unlike breach data, which only reveals a single record from a single company, infostealer data is a person’s entire digital footprint directly from their browser. Every website they saved a password to, the URL of every website that stored a cookie on their device, the names of their files and folders, their saved payment methods, autofill data, cryptocurrency wallet information, etc., it’s a treasure trove for investigators working any sort of case.

  Since this data is so powerful, it makes sense to implement a $1 search for infostealer data on every email address or phone number tied to your subject/case. Those few dollars of searches per case could be the difference between cracking a case with extensive digital footprint information and not finding anything useful at all. The potential for legitimate investigative use cases is truly unlimited with this new data source.

  Sign up for infostealers.info today and get 3 free demo searches before committing to purchasing credits and completing our KYC process.

  

• Data Available:

  • Saved passwords and logins from the browsers of over 50 million devices around the world (also contains the URL the password was saved to, providing a powerful digital footprint), over 20 billion records in total

  • Autofill data (Can include information like full name, billing addresses, shipping addresses, contact information, or anything else someone might save to their browser)

• Search By:

  • Phone Number

  • Email Address

  • Username

  • Domain

  • Password

  • Any Keyword - Name, Address, etc (Mostly restricted to autofill data searches)

  • COMP ID (Gets all of the data from a specific device)

  • NEW - Crypto Currency Address (Only available in the full platform) - Only Solana and ERC20 addresses are supported currently.

• Cost/Access:

  • $1 per credit (bulk discounts available), ~1-5 credits used per search, depending on the type

  • All accounts are required to pass a KYC check before being able to purchase credits.

  • Non-pro accounts will have a censored password field everywhere, the login field will be partially censored in domain search results, and the autofill values will be completely censored.

  • $200 per year for Pro access to get all results, including the censored results.

• Other Important Details:

  • It’s recommended to use infostealer data as a starting point and then perform parallel reconstruction efforts, as this data may not be admissible in court under the fruit of the poison tree doctrine.

  • The full platform provides additional data from infostealer logs, such as stored cookies (acts as a pseudo browsing history), autofill data (can include addresses), saved payment methods (credit cards), system information (file tree), and cryptocurrency wallets (trace hidden assets or unmask anonymous crypto users).

  • You can also export the raw contents of the logs with the full platform. Raw logs contain information vital for incident response (exact time of infection, device hostname, IP address, directory of infection, etc), and even more data useful for investigations like actual browsing history, desktop screenshots, installed programs, network information, installed crypto wallet information, and more.

  • In the full platform, you can also perform much more advanced searches, including keyword searches (with boolean and wildcard support), searches against URLs, file/folder names, crypto addresses/wallets, and any other field we index in our database! Go here to learn more about the full platform, and reach out for a free demo + trial: https://www.alerts.bar/

• Sign up to get 3 free demo search credits to test out the product!

• Law enforcement working in ICAC (internet crimes against children) units can reach out for free access at: info@alerts.bar, Please Title Your Email “ICAC Law Enforcement Access” and CC: aidan@alertsbar.net

Sign Up For Free Demo

📌 OSINT Industries Introduces New Advanced Filters, Making Search More Precise and Less Time-Consuming
OSINT Industries added advanced filters that allow investigators to run text searches, search by modules and specific fields, e.g., name, platforms, as well as to combine and reset the applied filters more easily. This makes the search for information more effective and less time-consuming.

These features also make sorting through less relevant search results much more efficient, as the process is automated, improving link analysis.

Watch a video showing how to apply the filters by following the link:

https://x.com/OSINTindustries/status/1994451224855294302?s=20

https://osint.industries/

Because each issue requires substantial time for in-depth research, analysis, and writing, the rest of this post is now available to paid subscribers only:

Subscribe now

Read more

In this Halloween special of the OSINT Insider, we will be exploring a very, very spooky part of the OSINT world, the underground/illegal side of it!

This edition will also cover:

• New Dating App Lookup Tool, Powerful Resource for Private Investigators, Could Aid in Pedophile Sting Operations, Infidelity Investigations

• Doogle.gg - A Ridiculously Powerful OSINT Tool for Discord, Could Be Used to Solve Cold Cases

• Massive Venmo Transaction Scrape, Downloadable and Searchable Database

• WACZ Files: Court Admissible OSINT Without the Cost

• New Tool Allows You To Pull Logs from Malicious Telegram Bots

• Tool for Exploring Strava Routes on a Map

• O’Reilly API Restricts Access, Removing OSINT Source for License Plate Lookups, Here’s An Alternative

• TeslaMap: Exposes Recent Location of Tesla Vehicles Around the World

• New Affordable Social Media Monitoring Service, Supports LinkedIn and X, With Plans to Add Facebook and Instagram Soon

• YouTube Video Finder Tool

• Novel Source of OSINF, Video Game Logs, Replay Files

• Denmark Joins Group of EU Countries Closing Public Access to Beneficial Ownership Information, Huge Blow to OSINT

• New Alternative to Seeker (Honeypot Creation Tool), With Additional Camera Access Feature

• Dark Watch, Empowers Counter Human Trafficking Investigators with Real-Time Intelligence, IMB Mapping, and Hospitality Industry Partnerships

• Changes Coming in the US Intelligence Community for OSINT

Previous Edition/New Special Edition:

In this special edition of the OSINT Insider, we dived deep into the connections and activities involving North Korean sympathizers, specifically those tied to KFA (Korean Friendship Association). Read more here.

OSINT News/New Tools:

In the last edition, we introduced this new section; now each newsletter comes with a digest of relevant news, tools, etc, for OSINT practitioners, increasing the overall value of the newsletter for readers.

📌 Changes Coming in the US Intelligence Community for OSINT
The US Intelligence community is moving full steam ahead on its initiatives in the world of OSINT, with new OSINT reforms included in the House Permanent Select Committee on Intelligence's fiscal 2026 intelligence authorization act. Some of the notable changes include setting new restrictions around how intelligence components can shift funding away from OSINT activities, standardizing OSINT tradecraft across the IC, and ensuring the accuracy of data. All important efforts to make OSINT a more mature field.

https://federalnewsnetwork.com/intelligence-community/2025/09/house-intel-bill-includes-major-osint-reforms/

📌 Dark Watch, Empowers Counter Human Trafficking Investigators with Real-Time Intelligence, IMB Mapping, and Hospitality Industry Partnerships
We recently came across a new company called DarkWatch and reached out to learn more about their capabilities. We were amazed at the tech they are building to aid counter-human trafficking efforts.

The two most impressive products we reviewed during our call were the illicit massage parlor maps and the product they provide to the hospitality industry.

Dark Watch provides a product to the hospitality industry that allows them to screen new guests against watchlists and external intelligence. This system not only allows hotels to avoid bad guests that could cause losses, but it can also help investigators track human traffickers around the country. This type of partnership is a game-changer, and the more their network of hospitality customers grows, the harder it is for human traffickers to get away with their atrocities.

The second product we reviewed that Dark Watch offers is a system that finds and maps suspected illicit massage businesses around the country. They scrape data from hundreds of sources, including review sites frequented by Johns. This is a great resource for law enforcement looking to target sex trafficking happening in their cities, as IMBs remain one of, if not the most common, ways people are sex trafficked in the United States.

While many organizations are going after human trafficking, far too many focus on flashy numbers and arrests/stings that have little effect on the overall problem of human trafficking and sex trafficking. This is because when one IMB closes, another opens, when one pimp is arrested, another takes their place, when one sick pedophile is caught, another is born, when one cartel is toppled, another rises, etc. These solutions are the complete opposite of what we have seen from this space; they aren’t trying to play the cat-and-mouse game themselves, they are building tools to make the cats (law enforcement officers, state counter human trafficking task forces, hospitality businesses, etc) much, much more effective at stopping human trafficking.

https://darkwatch.io/

📌 New Dating App Lookup Tool, Powerful Resource for Private Investigators, Could Aid in Pedophile Sting Operations, Infidelity Investigations

404media recently did a deep dive into two tools that allow you to find someone’s dating app profiles by both facial recognition and plain old name lookup. They did their own testing of the apps and proved they work. While 404media isn’t a fan of these apps, for the obvious privacy implications, we think these resources could be invaluable for private investigators working on infidelity cases. It could also be helpful for investigating child predators, allowing them to locate the profiles of known predators (such as by using the sex offenders registry) and attempt sting operations.

As of right now, only CheaterBuster has been tested and proven to work. However, there are many copycat sites, including ones going by CheatEye, that may also be effective in the event that CheaterBuster is no longer available.

https://www.cheaterbuster.com/

📌 New Alternative to Seeker (Honeypot Creation Tool), With Additional Camera Access Feature

We previously wrote a guide on creating powerful honeypots using an open source tool called Seeker:

This new resource has the same GPS geolocation functionality and built-in social engineering templates, but with additional intelligence collection features, including camera access attempts that, if successful, give the operator audio and video access to the subject for as long as they have the page open.

https://github.com/ultrasecurity/Storm-Breaker/tree/main

📌 New Tool Allows You To Pull Logs from Malicious Telegram Bots
A useful tool that allows you to take Telegram bot API keys from malware uploaded to sites like Any.run, and automate the process of retrieving data that is actively being sent to those Telegram bots. Very helpful for researchers monitoring malicious infrastructure, such as that tied to infostealer malware.

Demo video below:

https://github.com/0x6rss/matkap

📌 Denmark Joins Group of EU Countries Closing Public Access to Beneficial Ownership Information, Huge Blow to OSINT
The Court of Justice of the European Union (CJEU) ruled in 2022 that certain provisions of the EU’s Anti-Money Laundering Directive, which required public access to beneficial ownership information, were annulled. This decision has led to varied access to beneficial ownership information across EU member states, including Germany, Ireland, the Netherlands, and now Denmark.

As of September 1, 2025, Denmark has implemented new rules that restrict public access to beneficial ownership information in the Central Business Register (CVR). This change follows a ruling by the EU Court of Justice, which determined that unrestricted access to such data infringes on privacy rights.

https://andreasregnskab.dk/news/changes-in-access-to-beneficial-ownership-data-implications-for-danish-smes/

📌 Novel Source of OSINF, Video Game Logs, Replay Files

We recently came across a tool called slurs.tf that compiles logs from Team Fortress 2 gameplay and makes the chat logs of those games searchable via keyword or playername/steamID. This could be an invaluable resource, and Team Fortress 2 isn’t the only game where you can download such log files, also called replay files. This data could be operationalized for other games, too, and the files could be pulled from various locations, including speedrunning and community-run leaderboard websites (which often require you to provide replay files for new records).

https://slurs.tf/raw

📌 YouTube Video Finder Tool

An open source tool for finding archives of YouTube videos. Must have a link to the original video itself (even if the video is deleted or otherwise no longer available at the link). It can find copies of the video itself and archived metadata such as the title, description, thumbnail, and so on. The tool currently supports the following sources:

• YouTube

• Wayback Machine

• Archive.org Details

• Archive.org CDX (thumbnails)

• GhostArchive

• Distributed YouTube Archive

• Hobune.stream

• Filmot

• RemovedEDM

• Odysee

• PreserveTube

• Nyane.online

• Let’s Play Index

https://findyoutubevideo.thetechrobo.ca/

📌 Doogle.gg - A Ridiculously Powerful OSINT Tool for Discord, Could Be Used to Solve Cold Cases
A new Discord tool has emerged that utilizes the data collected by a Discord bot. Not just any Discord bot, but one of the largest bots used for verifying your Discord account when joining new servers, Double Counter. The bot works by requiring you to link your Discord account to their website and collecting basic information like your IP address. This is then used to detect accounts in their database that share the same IP address and prevent those accounts from joining Discord servers across multiple accounts. This was originally used to prevent ban evasion by effectively blocking alt accounts. But now you can query their entire Database by Discord username on Doogle.gg, allowing you to identify other Discord accounts that may belong to someone. This tool could be invaluable for finding new leads on long-dead cases of pedophilia and other crimes that happened via Discord. If you had a case where a Discord account was your only lead, this tool may help you find accounts linked to it, potentially opening up cold cases!

NoTextToSpeech, a popular Discord-centric YouTuber, produced a great video on this topic and the privacy implications of this new tool (including how you can opt out):

https://doogle.gg/search

📌 Massive Venmo Transaction Scrape, Downloadable and Searchable Database
Transactions scraped from the Venmo public API.

The data was collected during the following date ranges:

• July 2018 - September 2018

• October 2018

• Jan 2019 - Feb 2019

While there is no data for the amount transferred, it does include the following fields:

• date_updated

• app.description (Venmo for iPhone, Venmo for Android, etc)

• comments.count

• payment.id

• payment.target.user.username

• payment.target.user.last_name

• payment.target.user.is_group

• payment.target.user.is_active

• payment.target.user.profile_picture_url

• payment.target.user.is_blocked

• payment.target.user.id

• payment.target.user.display_name

• payment.target.user.first_name

• payment.target.type

• payment.audience

• payment.actor.username

• payment.actor.last_name

• payment.actor.is_group

• payment.actor.is_active

• payment.actor.profile_picture_url

• payment.actor.is_blocked

• payment.actor.id

• payment.actor.about

• payment.actor.display_name

• payment.actor.first_name

• payment.note

• payment.action

• payment.date_created

• audience

• likes.count

• and more!

You can use their Gigasheet to search the date here: https://app.gigasheet.com/spreadsheet/Venmo-Transactions-by-Dan-Salmon-github-com-sa7mon-venmo-data/56db56e2_acb7_4cc9_9d7a_ae308f5a2a06?public=true

Or download the data sets directly:

• Torrent: https://github.com/sa7mon/venmo-data/raw/master/venmo.tar.xz.torrent

• HTTPS: https://drive.google.com/drive/folders/1m59TMADiwk3gArT-teUUOBlSKokq51ZL

https://github.com/sa7mon/venmo-data

📌 New Affordable Social Media Monitoring Service, Supports LinkedIn and X, With Plans to Add Facebook and Instagram Soon
We came across this tool being shared on prominent OSINT subreddits recently, and were surprised by how affordable the service is in comparison to major social listening platforms that can cost 10’s of thousands a year.

https://multifollow.io/

📌 TeslaMap: Exposes Recent Location of Tesla Vehicles Around the World
This map shows the recent location of Tesla cars exposed by the faulty deployment of the TeslaMate software.

https://teslamap.io/

📌 O'Reilly API Restricts Access, Removing OSINT Source for License Plate Lookups, Here’s An Alternative
O’Reilly had an API that OSINTers discovered anyone could query for free with a license plate number and receive helpful information about the vehicle, including potentially the VIN and recent service visits. The cheapest legal alternative with similar data we could find was https://licenselookup.org/, which allows you to go from the license plate to the VIN number for just a few cents per query. This data is important because, for OSINTers, in many cases, you do not start with the VIN or even a full license plate number, so having a reliable, cheap way to get that information starting with a long list of potential license plate numbers, is quite helpful.

We recently used this data, paired with VIN lookup sites that can pull information like model number, manufacturer, year, etc, to help narrow down the correct license plate number for a victim of a hit and run incident, something we couldn’t do if we had to pay several dollars to a site like CarFax for each license plate number we wanted to check from the list.

https://licenselookup.org/

📌 Tool for Exploring Strava Routes on a Map

A new tool for finding Strava running/bicycling routes; it displays routes on a map so you can browse various routes from a particular area of interest. When you’ve identified a route, you can easily view more information about it and go straight to the author’s Strava profile to learn more about them:

https://www.doogal.co.uk/SegmentExplorer

Advertisement/Promotion

infostealers.info

🔗 URL: https://infostealers.info/invite/712CAE1F

🛡️ Defanged: [https://infostealers[.]info/invite/712CAE1F]

• Summary: Infostealer data is the new breach data, with billions of records publicly accessible online; it’s nonsensical not to make use of this powerful new OSINT data source.
  
  And unlike breach data, which only reveals a single record from a single company, infostealer data is a subject’s entire digital footprint. Every website they saved a password to, the URL of every website that stored a cookie on their device (yes, even those ones), the names of their files and folders, their saved payment methods, and autofill data, it’s a treasure trove for digital investigators.
  
  When you get a hit, the case is over; you have everything you need. Use it to identify users of CSAM distribution websites or cybercrime forums, use it to make an incredible leads list of your competitor’s product, make it your skiptracing or phone append super power, the potential is truly unlimited with this new datasource. Sign up for infostealers.info today and get 3 free demo searches!

• Data Available:

• • Saved passwords and logins from the browsers of over 50 million devices around the world (also contains the URL the password was saved to, providing a powerful digital footprint), over 20 billion records in total

  • Autofill data (Can include information like full name, billing addresses, shipping addresses, contact information, or anything else someone might save to their browser)

• Search By:

  • Phone Number

  • Email Address

  • Username

  • Domain

  • Password

  • Any Keyword - Name, Address, etc (Mostly restricted to autofill data searches)

  • COMP ID (Gets all of the data from a specific device)

  • NEW - Crypto Currency Address (Only available in the full platform @ info.fwintel.com) - Only Solana and ERC20 addresses are supported currently.

• Cost: $1 per credit

  • Non-pro accounts will have a censored password field everywhere to prevent misuse of data; the URL field remains uncensored everywhere, and the login field is only very partially censored in domain search results to prevent misuse.

  • $200 per year for Pro access (requires KYC) to get all results, including the censored results.

• Other Important Details:

  • The full password and autofill field values are censored for users who have not successfully undergone KYC. Only the URL and Login field are visible for non-KYCed users in order to prevent misuse of the data.

  • Additionally, no cookie data is provided in this platform whatsoever. We specifically do this to prevent account hijacking, the most dangerous potential use of infostealer data.

  • It’s recommended to use infostealer data as a starting point and then perform parallel reconstruction efforts, as this data may not be admissible in court under the fruit of the poison tree doctrine.

  • The full platform provides additional data from infostealer logs in search results, such as stored cookies (acts as a pseudo browsing history), autofill data (can include addresses), saved payment methods (credit cards), and system information (file tree). You can also export the raw contents of the logs, which contains information vital for incident response (exact time of infection, device hostname, IP address, directory of infection, etc), and even more data like actual browsing history, desktop screenshots, installed programs, cryptowallet information, and more. And you can search using more advanced search features, including keyword searches (with boolean and wildcard support), searches against URLs, credit card numbers, file/folder name search, and more! Learn more about the full platform here, and reach out for a trial: https://www.farnsworthintelligence.com/infostealer-data

• Sign up to get 3 free demo search credits to test out the product!
  
  Law enforcement working in ICAC units can reach out for free access at: lea@farnsworthintelligence.com

Sign Up For Free Demo

📌 WACZ Files: Court Admissible OSINT Without the Cost
While we’ve covered this before, this is a reminder that WACZ files allow for extremely high-fidelity court-admissible archives of websites, including those of dynamic sites like Facebook. If you use WebRecorder’s Chrome extension, you can also bypass typical anti-bot measures that would break the archive if it were collected from a service like WayBackMachine. We highly recommend the WebRecorder software for making high-quality admissible archives of websites. It’s free, it’s widely supported, and it’s standardized. There’s also a plethora of tools for working with WACZ files because of its wide industry adoption. Perfect for folks who need court-admissible archives, but cannot justify or afford to pay for services from companies like ForensicOSINT, Hunchly, etc.

If you are worried this might not be court-admissible, we’d recommend reviewing the standard specifications of the WACZ file format, which includes the common features advertised by the aforementioned paid tools, such as file hashing, timestamps, etc, as well as additional features that allow it to self-error correct and detect issues within the archive: https://specs.webrecorder.net/wacz/1.1.1/

The open-source nature of the WACZ file format and tooling also helps make it more defensible, as industry experts are able to verify the efficacy of the file format and technology in use by reviewing the code and specifications. Whereas with private tooling, a defense could argue that there is no way to verify that the tooling correctly archived the files or that something couldn’t have been included in the code that modified the files. Its open-source and transparent nature adds defensibility to the file format.

With WACZ files, you can even host file fidelity archives of pages for your clients, allowing them to view them as if they were still live (helpful for deleted accounts, impressive in a courtroom): https://webrecorder.net/replaywebpage/ (Also can be done using Perma.cc)

The WACZ file format and associated tools aren’t just good; they’re the industry standard, utilized by Archive.org and Perma.cc’s platform. Perma.cc is a platform that was developed by the Harvard Innovation Lab to prevent “link rot” and it uses the WACZ file format to achieve this. Perma.cc is now used across the Ivy League, including by Stanford Law: https://guides.law.stanford.edu/perma

We don’t see anything more defensible and useful than this in the space currently.

https://webrecorder.net/

If you appreciated how much value we put into this free OSINT digest section, please support us with a paid subscription:

Subscribe now

OSINT Internship Opportunities

More than half of all interns at Farnsworth Intelligence have now been able to work on real cases by participating in our Junior Analyst program, accessible to all interns regardless of whether they are helping with the knowledge base project or a part of the content/product development internship program. Here’s what one of them had to say about the experience:

”Amazing! Thank you so much for letting us work on this. I learned so much that I would never be able to on my own, and really enjoyed the process! Honestly, all of this was new for me; I’m really at the beginning of my OSINT journey. My experience with OSINT up until this point has been a lot of reading and some Sofia Santos/Bellingcat challenges, so this put together a lot that I read about and exposed me to new tools and analysis.”

We still have many openings for our Content and Product Development Internship, so if you know anyone in the marketing, communications, copywriting, or adjacent fields, we would encourage you to share this exciting opportunity with them: https://www.farnsworthintelligence.com/opportunities#cntproductdevinternship (Direct Link to Internship Listing)

We also just launched a Junior Developer Internship, perfect for anyone looking to gain real development experience for their resume, so if you know anyone in the software development or computer science fields, we would encourage you to share this exciting opportunity with them: https://www.farnsworthintelligence.com/opportunities#jnrdevinternship (Direct Link to Internship Listing)

Find out about our other internship opportunities here: https://www.farnsworthintelligence.com/opportunities

Today’s Post - Exploring the World of Underground OSINT:

Today’s post will focus on a loosely connected network of OSINT tools that primarily serve or market to the notorious online communities (the com) responsible for crimes such as extortion, cyberstalking, financial theft, account hijacking, digital asset theft, SIM swapping, and crypto draining.

Everything we claim in this edition is alleged; we are not lawyers, this is not legal advice, nor are they absolute claims. These are the conclusions we reached based on our expert understanding of the data ecosystem, but for legal reasons, it’s still alleged, and we can’t be 100% certain we are correct without direct access to the backends and architecture of these tools.

Additionally, unlike other posts, we do not recommend or endorse any of the tools we are about to share. In fact, for legal/operational security reasons, we recommend you do NOT use the tools we are going to share. You might also find that some of the tools we listed are already offline. This is due to the effierial nature of this space.

Some of the capabilities of the tools we are going to talk about today include:

• Reduced credit prices and/or free access to resources like IntelX, OSINT Industries, Orbitly, and hundreds of other paid tools (through stolen API keys)

• Unauthorized/potentially illegal access to regulated data from tools like TLOxp, Tracers, CarFax, and more

• Unethical non-KYCed access to incredibly sensitive data, like session keys derived from infostealers
  
  
  Want to see the rest of this post? You’ll need to become a paid subscriber first:

Subscribe now

Read more

If you enjoy The OSINT Insider Newsletter, it would mean the world to us if you invited friends and/or colleagues to subscribe and read with us. If you refer friends, you will receive benefits that give you special access to The OSINT Insider Newsletter’s paid content.

How to participate

1. Share The OSINT Insider Newsletter. When you use the referral link below, or the “Share” button on any post, you'll get credit for any new subscribers. Simply send the link in a text, email, or share it on social media with friends.

Refer a friend

2. Earn benefits. When more friends use your referral link to subscribe (free or paid), you’ll receive special benefits.

• Get a 1 month comp for 3 referrals

• Get a 3 month comp for 5 referrals

• Get a 6 month comp for 25 referrals

Visit the leaderboard

To learn more, check out Substack’s FAQ.

Thank you for helping get the word out about The OSINT Insider Newsletter!

This article was researched and written by Cory Bravo, an analyst at Farnsworth Intelligence.

On July 31st, the X account @browsercookies reported on an unknown individual who had posted a list containing information about approximately 200 members of the Korean Friendship Association (KFA). The list contained the email addresses, LinkedIn profiles, and X accounts of KFA members and chapters, ranging from Belarus and Sweden to Colombia and New Zealand. Furthermore, the list included several other organizations, which ranged from political parties and their constituent entities to various North Korean associations. The article will discuss a brief list of KFA members and will also include the chapters and North Korean associations at the end.

Alex Dillard

Alex Dillard is the Official Delegate and member of the KFA’s USA chapter and lives in Fremont, California. Dillard will repost posts made by Nodutdol, a U.S.-based organization that describes itself as organizing “for a world free of imperialism and for Korea’s re/unification and national liberation” on his Facebook profile. The organization shares views similar to those of KFA, particularly regarding the eventual reunification of Korea under North Korean leadership. However, Nodutdol lists San Jose Against War as one of the entities that endorsed the organization’s U.S. Out of Korea campaign. San Jose Against War made a post on its Instagram page on July 7th about the FBI seizing Dillard’s personal electronic devices during a search warrant. The FBI warrant is in relation to an alleged investigation they are conducting to determine if Dillard has any ties to Russia and if he is acting as a foreign agent on their behalf, according to San Jose Against War and FIGHT BACK News.

Dillard expresses a belief in communism based on examining his social media profiles. For example, the handles to his now-deleted Instagram and X accounts are marxengelsleninstalin1945 and AlexDillard1917, respectively. Both handles are linked to notable individuals or events related to communism, including the year 1917, which marks the Russian Revolution that led to the creation of the Soviet Union. His Instagram profile features the last names of notable communist and Soviet leaders, including Karl Marx and Josef Stalin. However, Dillard will also use usernames that reflect his communist views or sympathies, such as an American Marxist-Leninist username for his Truth Social profile.

He is very active on his Facebook and VK accounts, where he makes or reshares posts about notable individuals or events that involve the communist parties of other countries. For example, he reshared several posts about the Jordanian or Syrian communist parties, such as the deaths of prominent members or events, on his Facebook profile. Dillard also posted about pro-Palestinian or anti-Zionist protests or events that occur in California and other areas in the United States on his Facebook and VK accounts.

Regarding his now-deleted X account, Dillard has previously made comments that provided insight into his work with the KFA. The best example is how he made a post in September 2023 that he works with Jackson Hinkle through the KFA US Chapter, and how the “anti-imperialist communist sphere of politics will be far ahead of where it is now if all petty drama between creators stopped.” Dillard’s comment about “petty drama” alludes to the various comments he made on X and Telegram regarding his views on communism and anti-imperialism.

Graham Holton

Graham Holton is a likely member of the KFA’s Australia chapter. Holton is a member of the Communist Party of Australia (CPA) and the Secretary of its Sunshine Coast branch. He is a retired professor who previously taught at the University of Queensland, Australia, as a member of its School of Political Science & International Studies Department. However, Holton stated that he taught at other universities, such as La Trobe University, Melbourne University, and Royal Melbourne Institute of Technology (RMIT). He also attended most of the colleges from which he received his BA, PhD, and other advanced degrees, as indicated by his profiles on academia.edu’s UoQ and independent websites.

Holton regularly contributes articles to The Worker's Weekly Guardian, the party's weekly newsletter, as part of his association with the CPA. For example, he wrote two articles for its August 25th newsletter, titled “Queensland Teachers’ Strikes Update” and “Trump’s Culture Wars.” Holton wrote or appeared in other CPA publications, ranging from editorials to news articles about events that the entity held. For example, Holton wrote an article in October 2023 about how the CPA’s Brisbane and Sunshine Coast branches jointly held the Queensland Party School at the Waterloo Bay Hotel in the Brisbane suburb of Wynnum.

Regarding his association with North Korean entities, Holton attended a “joint gathering” that commemorated the 70th anniversary of the founding of North Korea on September 9, 2018, based on his Instagram profile picture. However, there are no additional indicators that would determine where the event was held. Furthermore, an examination of the KFA’s Australia Instagram profile did not reveal a post discussing the event. This, however, is likely due to chapter members deleting the posts that appeared on the profile prior to April 2019.

Dermot Hudson

Dermot Hudson is the Chairman of the KFA U.K. Chapter, the Chairman of the Juche Idea Study Group of England, and the President of the Association for the Study of Songun Politics U.K. Hudson holds an extremely positive view of communism and North Korea’s Juche and Songun ideologies. For example, his emails, Google account, and social media profiles have the words "Juche" or "Songun" in them, indicating his deep passion for the political ideologies. Hudson is very active on his social media platforms, with him making daily posts on his Facebook, Instagram, and X accounts about North Korea and criticizing the U.K.’s policies towards South and North Korea. Hudson also has some connections to other KFA chapters, such as the KFA U.S. chapter, based on a video he conducted with Ameer, a chapter member, in June 2024. He also made a post on X about the FBI conducting a search warrant at Alex Dillard’s residence.

Hudson traveled abroad extensively, including to Germany and North Korea. He ate at a German Democratic Republic (GDR)-themed restaurant called VolksKammer during a trip to Berlin, Germany, in 2023. Hudson wrote a Google review, under the username Songun007, about the restaurant and gave four stars. He praised the meal's portions, stating that “I have never seen such a big piece of chicken in my life people in the GDR must have eaten well.” However, he did complain about the meal’s cost, specifically of Vita Cola. Hudson also stated that Germany needed socialist prices and that the capitalist authorities in East Berlin allowed the area to decay.

Regarding his trips to North Korea, Hudson most recently traveled to Pyongyang in May 2024, based on a picture found on his Facebook profile. The picture was taken at the Arch of Triumph, a monument built by North Korea to commemorate the Korean resistance to Japan, which is located in the Triumph Return Square. The picture captured Hudson standing near the monument, donning sunglasses. He also likely stayed at or went to the Koryo Hotel during the trip, based on a reply he wrote to an individual regarding the black suit he wore in the picture. Hudson mentioned that he had the suit custom-made for him at the Koryo Hotel.

Hudson has previously traveled to North Korea, where he met or interacted with individuals who also shared his views. For example, he visited North Korea in 2008, where he met with members of the Anti-Imperialist National Democratic Front (AINDF) South Korea chapter. Hudson met and took a picture with Comrade Zo Il Min, then Chief for the AINDF’s mission to Pyongyang. The AINDF is guided by Juche and aims to foment a popular revolution that would cause the overthrow of the capitalist system, the removal of U.S. military presence from the Korean Peninsula, and reunification under North Korean rule. However, South Korea considers the organization a united front and a spy organization for North Korea and banned it under its National Security Law. The AINDF has significant connections to KFA as well as other North Korean organizations such as the General Association of Korean Residents in Japan (Chongryon) and the now-dissolved Democratic Front for the Reunification of Korea.

Mehmet Adnan Akfirat

Mehmet Adnan Akfirat is a member of the KFA's Turkey chapter and holds several positions at Chinese-Turkish associations and companies. Akfirat is the vice chairman at China-Turkiye Trade Development (Xinjiang) Co. Ltd. and the owner of the Turkish-Chinese Business Matching Center (TUCEM). He is a visiting fellow at Shanghai University’s Center for Turkish Studies and chairman of the Turkish Chinese Business Development and Friendship Association (Türk-Çin İş Der). Türk-Çin İş Der has substantial ties to the China People's Friendship Association for Foreign Countries (CPAFFC), a Chinese organization that promotes diplomacy and increased understanding between countries using people-to-people exchanges. However, the CPAFFC functions as a United Front organization for China, aiming to enhance its influence in various countries to further its objectives.

Akfirat is a longtime member of the Turkish political party, Vatan Partisi (VP). Specifically, he is a member of the party's International Relations Bureau and acts as its representative to China. The political party styles itself as a “vanguard party” that embraces and seeks to continue the “nationalist, populist, and socialist heritage of the Turkish Revolution under a single discipline.” Furthermore, VP is considered a far-left party and is the successor to the İşçi Partisi (IP) that was banned in 2015 by the Constitutional Court. The party supports strong relations with anti-imperialist countries, such as North Korea, and delegations have traveled to the country, with the most recent trip occurring in 2018. However, there are no indications that Akfirat was with the delegations that traveled to North Korea. He was also heavily involved in establishing several publications that predate the IP's establishment, based on an article about the history of its newsletter, Aydinlik. Akfirat is likely one of the founding members of the IP based on his close associations with the Aydinlik and other individuals during the 1980s and early 1990s. He also tried in at least one court case along side the current VP Chairman, Doğu Perinçek, in the 1971 related to the creation of the Revolutionary Workers' and Peasants' Party of Turkey.

Calvin Chua

Calvin Chua is a member of KFA, an Associate Professor of Practice at Singapore University of Technology and Design, and the founder of Spatial Anatomy. Spatial Anatomy is a Singapore-based company that specializes in design consultancy, strategic research, feasibility studies, and project management. However, Chua is also the Associate Program Head at Chosen Exchange, a Singapore-based program that seeks to bring “dynamic young professionals and entrepreneurs to North Korea as volunteers to train an emerging generation of entrepreneurs and businesspeople” in the country. Chosen Exchange provides sponsorship to North Koreans for various overseas trips and programs, exposing them to fields such as economic policy and financial sector development. The entity seeks to create the first generation of modern startups in the isolated country and to help break down walls by tapping into cultural and knowledge exchanges. Chosen Exchange also creates reports on North Korea’s economic policy and investment laws, as well as analysis on political or social issues that relate to North Korea.

Chua likely has not traveled to North Korea based on examination of his Facebook and Instagram profiles. However, it should be noted that Chua lived in South Korea from March 2022 to February 2023 and in Madrid, Spain, for approximately four years from 2014 to 2018. Chua could have met with the President of the KFA, Alejandro Cao de Benós, and attended gatherings of the organization during the time he spent in Spain, but it cannot be definitely determined.

Indicators of KFA Association

Below is a list of organizations and emails that may provide indication that the individual is a member of KFA. However, it should be noted that the list is not inclusive, and it does not provide definitive proof that the individuals are associated with North Korea’s illicit activities or networks.

Political Parties/Trade Unions

Kilusang Mayo Uno/Kilusang Mayo Uno KMU

Location: Philippines
Email: kilusangmayouno@gmail.com
Facebook: https://www.facebook.com/kilusangmayouno
Instagram: https://www.instagram.com/kilusangmayouno
LinkedIn: https://www.linkedin.com/in/kilusang-uno-81a80632
X: https://x.com/kilusangmayouno

Kilusang Mayo Uno (KMU) is a Quezon City, Philippines-based labor union that is led by Jerome Adonis. The organization advocates for workers’ rights and against foreign domination of the Philippines. KMU is fairly active on social media and actively maintains its website. The trade union is leftist and anti-imperialist in terms of ideology and politics.

UMA Pilipinas

Location: Quezon City, Philippines
Email: uma.pilipinas@gmail.com
X: https://x.com/UMApilipinas
Facebook: https://www.facebook.com/uma.phl/
Instagram: https://www.instagram.com/umapilipinas/
LinkedIn: N/A

UMA Pilipinas is a federation of trade federations, associations, organizations, and unions for agricultural workers in the Philippines. The organization exhibits leftist leanings and maintains close ties with the KMU and other Philippine labor trade unions.

Vatan Partisi INT

Location: Turkey
Email: international@vatanpartisi.org.tr
X: https://x.com/VatanParty_INT
Facebook: https://www.facebook.com/p/Vatan-Partisi-Turkey-International-100066736084578/
Instagram: N/A
LinkedIn: N/A
X: https://x.com/VatanParty_INT

Vatan Partisi INT is VP’s International Relations Bureau.

Oncu Genclik

Location: Turkey
Email: oncu.genclik@vatanpartisi.org.tr
Facebook: https://www.facebook.com/VatanPartisiOncuGenclik/
Instagram: https://www.instagram.com/oncugenclik/
LinkedIn: N/A
X: https://x.com/OncuGenclik

Oncu Genclik (Pioneer Youth) is VP’s youth branch.

North Korea Associations or .kp/edu.pk Emails

Below is a short list of emails that have the North Korean internet domain or are associated in some way with entities linked to the country. It should be noted that the emails are not inclusive, and they do not provide definitive proof that the individuals are associated with North Korea’s illicit activities or networks.

dmw@star-co.net.kp
chollima.lanka.korea@gmail.com
geoffrey.see@chosonexchange.org (Text is likely corrupted)

KFA Chapter Emails

Below is a chart that shows the 26 KFA chapter emails that are associated with their respective country. The emails are divided by their respective country and region. Europe has the most KFA chapter emails (9), followed by North and Latin America (8), with Africa and Asia having four chapter emails. The KFA Palestine chapter email is the only one associated with the Middle East/North Africa region.

Below is a list of the KFA chapter emails that is separated by region in alphabetical order.

Europe:

bulgaria@korea-dpr.com
finland@korea-dpr.com
france@korea-dprk.com
greece@korea-dpr.com
germany@korea-dpr.com
italy@korea-dpr.com
portugal@korea-dpr.com
sweden@korea-dpr.com
swisskfa@gmail.com

Africa:

ethiopia@korea-dpr.com
ghana@korea-dpr.com
kenya@korea-dpr.com
zimbabwe@korea-dpr.com

Asia:

korea@korea-dpr.com
india@korea-dpr.com
cambodia@korea-dpr.com
australia@korea-dpr.com

North/Latin America:

argentina@korea-dpr.com
bolivia@korea-dpr.com
brazil@korea-dpr.com
canada@korea-dpr.com
chile@korea-dpr.com
colombia@korea-dpr.com
elsalvador@korea-dpr.com
mexico@korea-dpr.com

Middle East/North Africa:

palestine@korea-dpr.com

Want to support more work like this? Become a paid subscriber to the OSINT Insider:

Subscribe now

There are many OSINT data sources and tools that can be invaluable when performing investigations, but some data sources are restricted to certain professionals, such as licensed private investigators. This is because these data sources provide legally protected data, such as credit header data. Today, we are going to talk about data sources like these, a rogue OSINT tool illegally selling it, and the risks associated with it.

This edition will cover:

• New OSINT Tools/News

  • Fascinating List of Threat Actor Datasets

  • Tool to Analyze Push Tokens

  • New OSINT Tool, Find Location of Screenshot Using The Weather

  • Tool for Monitoring GPS Jamming Globally

  • Tool for Finding the True Owner of NYC Property

  • Massive New Reddit Database (More than 3.6 TB!)

  • New Instagram Map Feature, OSINT Goldmine?

  • FaceSeek, New Facial Recognition Platform

  • Tool for Finding Instagram Posts from Private Profiles

  • New OSINT Tool Has Unique Discord Username History Feature and Discord IP Address Data

  • Free Alternative to Forensic OSINT, A Tool for Forensic Evidence Collection

  • New Tool, Ship Wreck Tracker

  • New Tool, Mega.nz File Search Engine

  • and more

• Laws Protecting Certain Kinds of Data

• Explanation of Credit Header Data

• An OSINT Tool Breaking Federal Law?

Previous Edition/New Special Edition:

In this special edition of the OSINT Insider, we dived deep into the connections and activities involving North Korean Universities and the rest of the world. From uncovering knowledge sharing deals between North Korean and Russian/Chinese universities to analyzing satellite imagery of North Korea’s expanding university campuses. Read more here.

OSINT News/New Tools:

Starting with this edition, each newsletter will now come with a digest of relevant news, tools, etc, for OSINT practitioners, increasing the overall value of the newsletter for readers.



📌 Fascinating List of Threat Actor Datasets by Yury Sergeev
Yury analyzed how many unique threat actor profiles each data source on the list has.

https://www.linkedin.com/feed/update/urn:li:activity:7332993229232971776/

📌 New OSINT Tool, Weather2Geo
People post screenshots with the Windows weather widget in their taskbar all the time, showing the exact temperature, weather condition, and local time. This tool uses the same API as the widget to find cities where those conditions are currently true.

https://github.com/elliott-diy/Weather2Geo

📌 Tool For Monitoring GPS Jamming Around the World
Recent activity on the US-Mexico border with GPS jamming brought this tool into the spotlight once again. It was used to monitor the use of GPS jamming tech by cartels in an OSINT Discord server recently. Here’s an unrelated article on the subject of GPS jamming by cartels if you’d like to learn more: https://dronexl.co/2024/10/13/mexican-cartels-drone-jamming-border-surveillance/

https://gpsjam.org/

📌 Tool for Identifying Property Owners in NYC
A new tool, by the JustFix project, aims to help tenants in NYC identify their landlords based on ownership information. Can search by name or legal entity, which can be helpful with identifying portfolios of properties, hidden under shell structures.

https://whoownswhat.justfix.org/en/

📌 Free Alternative to Forensic OSINT, A Tool for Forensic Evidence Collection
Free alternative to paid tools like Forensic OSINT has the following important features:

• Signed Hash for verifying each screenshot's integrity

• Multiple timestamps are collected

• Multiple attributes about the computer that took the screenshot are captured

• Source code is Open Source

https://github.com/yooper/your-rapport

📌 LolArchiver Significantly Expands Module Support
lolarchiver, an emerging top competitor to tools like OSINT Industries and Epieos, has recently added support for an additional 100+ sites, including infrequently supported sites like KiwiFarms, Exploit.in, etc. They also expressed plans to add username search support for over 400 sites over the next couple of months!

https://x.com/lol_archiver/status/1956460179953766714

Advertisement/Promotion

infostealers.info

🔗 URL: https://infostealers.info/invite/712CAE1F

🛡️ Defanged: [https://infostealers[.]info/invite/712CAE1F]

• Summary: Infostealer data is the new breach data, with billions of records publicly accessible online; it’s nonsensical not to make use of this powerful new OSINT data source.
  
  And unlike breach data, which only reveals a single record from a single company, infostealer data is a subject’s entire digital footprint. Every website they saved a password to, the URL of every website that stored a cookie on their device (yes, even those ones), the names of their files and folders, their saved payment methods, and autofill data, it’s a treasure trove for digital investigators.
  
  When you get a hit, the case is over; you have everything you need. Use it to identify users of CSAM distribution websites or cybercrime forums, use it to make an incredible leads list of your competitor’s product, make it your skiptracing or phone append super power, the potential is truly unlimited with this new datasource. Sign up for infostealers.info today and get 3 free demo searches!

• Data Available:

• • Saved passwords and logins from the browsers of over 50 million devices around the world (also contains the URL the password was saved to, providing a powerful digital footprint), over 20 billion records in total

  • Autofill data (Can include information like full name, billing addresses, shipping addresses, contact information, or anything else someone might save to their browser)

• Search By:

  • Phone Number

  • Email Address

  • Username

  • Domain

  • Password

  • Any Keyword - Name, Address, etc (Mostly restricted to autofill data searches)

  • COMP ID (Gets all of the data from a specific device)

• Cost: $1 per credit

  • Non-pro accounts will have a censored password field everywhere to prevent misuse of data; the URL field remains uncensored everywhere, and the login field is only very partially censored in domain search results to prevent misuse.

  • $200 per year for Pro access (requires KYC) to get all results, including the censored results.

• Other Important Details:

  • The full password and autofill field values are censored for users who have not successfully undergone KYC. Only the URL and Login field are visible for non-KYCed users in order to prevent misuse of the data.

  • It’s recommended to use infostealer data as a starting point and then perform parallel reconstruction efforts, as this data may not be admissible in court under the fruit of the poison tree doctrine.

  • The full platform provides additional data from infostealer logs in search results, such as stored cookies (acts as a pseudo browsing history), autofill data (can include addresses), saved payment methods (credit cards), and system information (file tree). You can also export the raw contents of the logs, which contains information vital for incident response (exact time of infection, device hostname, IP address, directory of infection, etc), and even more data like actual browsing history, desktop screenshots, installed programs, cryptowallet information, and more. And you can search using more advanced search features, including keyword searches (with boolean and wildcard support), searches against URLs, credit card numbers, file/folder name search, and more! Learn more about the full platform here, and reach out for a trial: https://www.farnsworthintelligence.com/infostealer-data

• Sign up to get 3 free demo search credits to test out the product!
  
  Law enforcement working in ICAC units can reach out for free access at: lea@farnsworthintelligence.com

Sign Up For Free Demo

📌 New OSINT Tool Has Unique Discord Username History Feature and Discord IP Address Data

WARNING: This tool may be connected to a loose network of potentially criminal OSINT tools; use at your own risk.

Oathnet, a new OSINT tool, comes onto the scene with features commonly seen elsewhere in the industry, but with a unique Discord username history module. The tool is already down as of the last revision to this section (8/21/2025).

At least some of the Discord data for this tool is likely sourced from previous breaches or authorized resale of data from 3rd-party Discord bots, such as VaultCord, LightningCord, RestoreCord, etc. Speculations in TikTok videos featuring the tool agree:

https://oathnet.org/

📌 BigBang, A Better Lightweight Alternative to Free Tools from HuntIntel

Find content based on location, from Google, Instagram, Facebook, and Twitter. Similar to the freemium tools offered by HuntIntel, such as InstaHunt, but with no rate limits.

https://www.majdkhalifeh.com/bigbang

📌 New Tool for Analyzing Push Tokens

Push tokens are unique identifiers assigned to mobile devices by notification services (Apple APNs, Google FCM). In OSINT investigations, these tokens can be found in leaked databases, app logs, or through device forensics. Analyzing push tokens can help link devices to specific users, identify the type of device, or correlate activity across multiple platforms.

https://github.com/HawkEyes-OSINT/PushToken_Analysis

📌 New Facial Recognition Tool, FaceSeek, Misleading Claims from Reddit (Again), A Little Less Shadyness

FaceSeek has recently come onto the scene as a competitor to tools like FaceCheck.

While some Redditors have claimed it is simply reselling FaceCheck results, we ran searches against it using faces that have been removed from FaceCheck results. These removed results still appeared on FaceSeek, which would be impossible if they simply resold results from FaceCheck. This test is important because having the same results from two tools does not always mean they are stealing from one another; it could just be that their coverage is very similar. This test, however, does not preclude the possibility that FaceSeek has stolen FaceCheck’s private database of scraped faces + source URLs, or any other possible explanation.

The company appears to be located in the same location as the offices of FaceOnLive (according to the address in their footer), a seemingly legitimate and potentially affiliated company in Canada with a legal business registration and a large online footprint. Their business records also openly disclose their directors (Jesse Zhang and Volodymyr Hrynkevych). However, this company was recently dissolved for noncompliance by the Canadian government (https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?corpId=14556313)

Jesse Zhang shares the name of a few different AI/ML experts and other technical experts, making it unclear which real Jesse Zhang actaully started this company (if any). The location of their office appears to be a registered agent, with many other businesses operating out of the same location. This is, at least, a little less shady than the mysterious origins of FaceCheck.id, whose offices are located in Belize, in the same location as other shady businesses included in the Panama Papers (https://offshoreleaks.icij.org/nodes/14085279)

Discovering who is really behind FaceOnLive does seem doable, and we would encourage other researchers to look into this.

https://www.faceseek.online/

📌 Massive New Reddit Dataset, Scrape of 99% of Reddit, 3.46 TB in size!

The developers behind Pushshift recently released what is likely the largest scrape of Reddit so far. They claim to have scrapped 99% of the site, and the data is freely available. The dataset includes the content and author, making it highly useful for OSINT purposes. The data is 3.46 TB in total size, but consists of smaller chunks (~20 GB each) separated by date range.

https://academictorrents.com/details/30dee5f0406da7a353aff6a8caa2d54fd01f2ca1




📌 New Instagram Tool Pulls Posts from Private Profiles

This script allows you to pull any posts a private Instagram profile was tagged in via the Instagram API. It does this using a hardcoded app ID; however, this app ID belongs to an internal Instagram service and is unlikely to be changed (You can find the app ID it uses in here: https://www.instagram.com/static/bundles/es6/ConsumerLibCommons.js/faada8fcb55f.js) This isn’t the first such script to pull this off (others using the same app ID are findable on Github), however it seems to be the first to focus on private Instagram profile data and linked posts.

https://github.com/obitouka/InstagramPrivSniffer

📌 New Instagram Map Feature, SnapMaps Goldmine 2.0?

SnapMaps was a boon for OSINT (Link goes to an OSINT tool for the now-defunct public SnapMap webpage - SnapMaps is only accessible via the Snapchat app now). Could this new Instagram map feature be the same? It’s only a matter of time until tool developers make it apparent just how useful this feature could be for OSINT.

https://techcrunch.com/2025/08/06/instagram-takes-on-snapchat-with-new-instagram-map/?user_id=66c4c85b5d78644b3ac0c88c

📌 New Tool, Ship Wreck Tracker
A new tool that catalogues and maps detailed information about ship wrecks, including how they sank, IMO’s, the location, ship owners, etc.

https://github.com/Alfredredbird/Open-Wrecks

📌 OSINT Tip: Accessing Any Neighborhood on Nextdoor
A new post by Steven Mason features an overlooked tactic for finding unknown witnesses or gathering hyperlocal intelligence: using Nextdoor (the app)

While many assume you're limited to your neighborhood, Mason explains that you can access posts from other areas, a game-changer for proximity-based investigations.

Profiles often include full names, and the platform’s casual tone leads to open discussions that can surface leads, verify timelines, or confirm who was active in a particular area. Mason credits this method with reviving dead cases and deepening client relationships.

https://www.linkedin.com/feed/update/urn:li:activity:7349190602447626242/


📌 New Tool, Mega.nz File Search Engine
A new search engine for finding unlisted files hosted on Mega.nz! Claims to have indexed over 9 million files. Search by file name or browse categories. 🎩 H/T: Jake Creps, The OSINT Newsletter

https://meawfy.com/


If you appreciated how much value we put into this free OSINT digest section, please support us with a paid subscription:

Subscribe now

OSINT Internship Opportunities

More than half of all interns at Farnsworth Intelligence have now been able to work on real cases by participating in our Junior Analyst program, accessible to all interns regardless of whether they are helping with the knowledge base project or a part of the content/product development internship program. Here’s what one of them had to say about the experience:

”Amazing! Thank you so much for letting us work on this. I learned so much that I would never be able to on my own, and really enjoyed the process! Honestly, all of this was new for me; I’m really at the beginning of my OSINT journey. My experience with OSINT up until this point has been a lot of reading and some Sofia Santos/Bellingcat challenges, so this put together a lot that I read about and exposed me to new tools and analysis.”

We still have many openings for our Content and Product Development Internship, so if you know anyone in the marketing, communications, copywriting, or adjacent fields, we would encourage you to share this exciting opportunity with them: https://www.farnsworthintelligence.com/opportunities#cntproductdevinternship (Direct Link to Internship Listing)

We also just launched a Junior Developer Internship, perfect for anyone looking to gain real development experience for their resume, so if you know anyone in the software development or computer science fields, we would encourage you to share this exciting opportunity with them: https://www.farnsworthintelligence.com/opportunities#jnrdevinternship (Direct Link to Internship Listing)

Find out about our other internship opportunities here: https://www.farnsworthintelligence.com/opportunities

Today’s Post - OSINT Tool Breaks Federal Law?:

Today’s post is going to focus on a specific OSINT tool that is potentially breaking US federal law, but before we can get to the tool, we are going to provide background information on the laws affecting certain kinds of data. Additionally, after we talk about the tool, we will provide information about how we determined it may be breaking a federal law.

Everything we claim in this edition is alleged; we are not lawyers, this is not legal advice, nor are they absolute claims. These are the conclusions we reached based on our expert understanding of the data ecosystem, but for legal reasons, it’s still alleged, and we can’t be 100% certain we are correct.

Want to see the rest of this post? You’ll need to become a paid subscriber first:

Subscribe now

Read more

Key Points

• North Korea drastically expanded its cyber operations in the past five years to include cyberattacks against cryptocurrency exchanges and industrial espionage.

• While Kim Il Military University plays a significant role in North Korea’s cyber operations, Kim Il Sung University and Kim Chaek University of Technology also play a key role.

• North Korean universities will leverage their relationships with their Chinese and Russian counterparts to advance their cyber and Artificial Intelligence (A.I.) capabilities.

• Both Kim Il Sung University and Kim Chaek University of Technology increased their relationships with several Russian universities, such as Novosibirsk State University and Bauman Moscow State Technical University, to advance their cyber and A.I. capabilities.

• The three universities will also leverage their relationships with Chinese universities such as Peking University, Tsinghua University, and the National Defense University of Technology to advance their goals regarding cyber and A.I.

The report uses admiralty codes to provide readers a sense of the accuracy of the assessments it contains. They will be found at the end of sentences or paragraphs in parentheses. Below is a diagram showing readers how to interpret the codes found throughout the report. We used several sources that we cannot include, as there is a risk of losing access to them if they are exposed, to inform our admiralty codes and findings.

In the past five years, North Korea significantly expanded its cyber operations, ranging from cyberattacks against cryptocurrency exchanges to industrial espionage. The expansion also included Research and Development (R&D) efforts to integrate A.I. into these operations as well as for other uses (Jeong, Tae Joo). Although Kim Il Sung Military University (KISMU) plays a significant role in these activities, as Michael Barnhart states in his DTEX report titled "Exposing DPRK’s Cyber Syndicate and Hidden IT Workforce," other universities also play a substantial role (Barnhart). Kim Il Sung University (KISU) and Kim Chaek University of Technology (KCUoT) historically played a key role in developing and using new technologies, such as cyber tools and A.I., to achieve North Korea’s goals and will continue to do so (B2). The universities' relationships with Chinese and Russian universities are also used by North Korea to significantly bolster its cyber and A.I. capabilities (A2). We spoke with Barnhart about KCUoT and KISU's visits to their Chinese and Russian counterparts, and he highlighted how important they are to North Korea:

“The DPRK doesn’t have the luxury of broad international partnerships, so it leans on these relationships to fill training gaps, acquire technical insights, and maintain relevance in strategic domains. These academic exchanges, though small and often underreported, are critical threads in North Korea’s larger technology acquisition strategy.”

Kim Il Sung University (김일성종합대학)

KISU was established in 1946 and is considered one of North Korea's leading universities. The university conducts R&D in various fields via the ten research institutes that fall within the institution. However, three institutes likely focus on research on cybersecurity and A.I. The institutes are the Electronic Calculator Research Institute, the Computational Research Institute, Institute for Advanced Technology Development, and the A.I. Technology Research Institute. The A.I. Technology Research Institute conducts research on A.I. development for use by North Korea (A1). The institute uses foreign-developed A.I.s, such as ChatGPT, to train students on how to integrate and utilize them during research. The state-owned media outlet Voice of Korea showed researchers reading a slide titled “GPT-4 Example: Writing” with two prompts in English during a February 2025 news segment about A.I. research at KISU (Choi, Hee-jin). The slide was part of a larger slideshow that explained ChatGPT's capabilities. The institute likely uses other A.I.s, such as Claude, Perplexity A.I., and DeepSeek, to conduct research on how to apply A.I. to achieve North Korea's aims (B2).

Regarding the Electronic Calculator Research and Computational Research Institutes, they focus on IT and other aspects of cybersecurity. This research includes collaboration with and outreach to universities in other countries such as China and Russia (A1). Barnhart also pointed out how “the visits by staff to universities in China and Russia should be viewed through the lens of strategic necessity, not ideological alignment.” However, these collaborations and meetings occurred before North Korea expanded its cyber operations. In October 2013, the Vice President of KISU, Choi Jeong-ho, led a delegation to visit Peking University in Beijing, China. During the visit, Choi met with staff and faculty from the university’s School of Information Science and Technology and discussed various topics. One topic was selecting individuals to take part in student exchange studies at the university. Choi also pointed out that both universities share similar origins and development, along with common research areas, which will be important for facilitating future cooperation between the institutions.

North Korea also reached agreements with Russia to increase research and cooperation in the information technology field using their universities (A1). In April 2025, Novosibirsk State University (NSU) announced that KISU is planning to open a representative office on its campus. The university made the announcement after a delegation led by KISU President Kim Seung-chan visited the university to meet with their Russian counterparts in late January 2025. During the meeting, Kim and NSU President and Russian Academy of Sciences member Mikhail Fedrouk agreed to intensify cooperation between the two universities using student and faculty exchanges and joint scientific research in information technology and other fields. They also agreed that both universities will develop a joint roadmap to effectively organize their efforts this year.

The two countries, however, previously discussed ways to increase cooperation between Russian universities and North Korean research institutes (A1). In May 2024, the Russian Minister for Science and Higher Education, Valery Falkov, held a working meeting with Kee Chun-gil, the Chairman of the State Committee for Science and Technology of North Korea. The delegations discussed ways to increase joint cooperation between Russian universities and North Korean institutes, specifically in information technology, ecology, and agriculture. The Russian Minister for Development of the Far East, Alexey Chekunkov, stated that North Korea requested that Russia increase its quota for North Korean students allowed to study information technology and construction in the country. Chekunkov held a working meeting with Sin Hong-chol, the Ambassador Extraordinary and Plenipotentiary of the DPRK to the Russian Federation, during the St. Petersburg International Economic Forum in June 2022. Both Checkunkov and Sin also discussed increasing scientific cooperation between the two countries during the meeting.

Additional Photos

Kim Chaek University of Technology (김책공업종합대학)

KCUoT is considered the best engineering and technology university in North Korea and conducts significant R&D in A.I. and cybersecurity (A1) (Choi, Hyun-seok). The university’s R&D in A.I. and cybersecurity will be conducted through the Information Technology Research Institute, the Designing Information Research Institute, and the Information Communication Research Institute. While the university's recent activities are extremely limited, more information exists about its past activities (A1). For instance, a team from the university placed 8th in the 2019 International Collegiate Programming Contest (ICPC) World Finals held in Porto, Portugal (Williams). The team also placed first in the 2019 ICPC Asia East Regionals held in Xi’an, China, where it beat several notable Chinese universities, such as Peking and Tsinghua Universities (Competitive Programming Hall of Fame). North Korean leader Kim Jong Un said that the university will play a key role in advancing the country’s science and technology during its 75th anniversary in 2023 (Jeong, Gyo-jin).

The university also sent delegations to visit Chinese and Russian universities (A1). In July 2019, a delegation led by then KCUoT President Hong So-hon, Jon Ji-hyon, the Director of the Post and Telecommunications Department, and other staff visited Tsinghua University in Beijing, China. During the visit, Hong and the delegation visited various laboratories and institutes, such as the State Key Laboratory of Power System and Energy Internet Innovation Institute. However, KCUoT staff visited five Russian universities to meet with leadership and to sign agreements between late January and early February 2025 (Посольство России в КНДР/Russian Embassy in the DPRK). During the delegation’s visit to Kazan Federal University (KFU), KCUoT President Park Ji-min met with his counterpart, Lenar Safin, to discuss ways to increase cooperation between the two universities. The delegation also toured various institutes, including the Institute of A.I. and the Institute of Information Technology and Intelligent Systems. At the end of the visit, Park and Lenar signed an agreement to increase cooperation in information technologies, medicine and bioengineering, etc.

The delegation also visited Moscow Power Engineering Institute (MPEI), where they toured various institutes, such as the Institute of Power Engineering and Mechanics. The MPEI and the KCUoT delegations also discussed ways to enhance cooperation, increase opportunities for MPEI to train KCUoT students and postgraduates, and conduct joint research. Park and other faculty visited Bauman Moscow State Technical University (BMSTU), where they visited the Center for Monitoring and Cybersecurity. The center contains the university’s Security Operations Center (SOC) that monitors BMSTU’s information infrastructure and identifies and responds to potential cyber threats. However, the center also trains students through professional education programs that provide them practical cybersecurity skills. The center's head gave a tour and presentation that outlined its research areas, such as A.I. and its applications and cyber threats. Mikhail Gordin, the President of BMSTU, and Park signed a protocol agreement to increase cooperation between the two universities. The delegation also visited the Far East Federal University, where they discussed increasing cooperation in biomedicine and medical training. A delegation from KISU, led by Kim Seung-chan, was also present during the KCToU visit. Finally, Park and the delegation visited the Lomonosov Moscow State University as part of the trip.

Kazan Federal University Visit Photos

Moscow Power Engineering Institute Visit

Bauman Moscow State Technical University Visit

Far Eastern Federal University Visit

Kim Il Sung Military University (김일성군사종합대학)

KISMU is a university that differs from KISU and KCToU since it was created to train officers belonging to the Korea’s People’s Army (KPA). The university conducts research into A.I. and cybersecurity through its College of Computer Science. KISMU also conducts research using the Computer Network Lab, Data Security Lab, and Software Engineering Lab. Furthermore, KISMU offers programs focused on A.I. and cybersecurity, including those that protect against hacker intrusions, develop A.I. technologies, and provide Linux distribution programs for multilingual processing.

While KISMU does not publicize its activities or visits to its Russian or Chinese counterparts, satellite imagery reveals significant activity at some buildings that are associated with the university (B2). Additionally, the report titled “The Pyongyang Diamond Pt. 1: A Look Inside Mangyongdae District” discusses changes in other locations associated with KISMU. The DTEX report also discusses the important role it plays in developing cadres for North Korea’s cyber programs.

1. 38°59'58.75"N, 125°40'29.15"E

The coordinates are for a building located along the banks of the Taedong River and are likely associated with Kim Il Sung Military University (KISMU) and the North Korean military (B2). This assumption arises from the building’s proximity to the university and the construction that took place between 2019 and 2021, which altered the overall layout of the complex (B2). However, as noted in the CyberBlade report, the area has developed since 2015, which points to the location’s evolving role in KISMU and North Korea’s military cyber activities.

This construction indirectly correlates to North Korea’s increasing its cyber operations against various targets after 2021 (Matishak). Furthermore, the building would support North Korea’s efforts to advance its cyber capabilities to conduct operations against various targets across the globe (B2).

2. 39° 0'12.79"N, 125°40'56.74"E

The second coordinates are for a complex located approximately 0.47 miles (0.76 kilometers) northeast of the first building. The complex is likely part of the KISMU campus because of its proximity to the university (B2). Furthermore, the construction took place over the same three-year period as the first building.

3. 39° 1'2.18"N, 125°41'53.40"E

The third coordinates are for a complex that is made up of multi-story buildings located approximately 1.71 miles (2.76 kilometers) northeast of KISMU. Based on the analysis of imagery, the complex has not undergone any construction or renovation between 2019 and 2024 (A1). The building's occupant is unknown, but it is likely linked to the North Korean government or military. This assumption is based on the complex's location relative to KISMU and the Red Flag Mangyongdae Revolutionary School, a school that serves the North Korean elite based in Pyongyang (B2).

Additional Photos

Additional imagery was removed for brevity but is available upon request (Figures 15, 16, and 20).

Works Cited

Note: We used several sources that we cannot include, as there is a risk of losing access to them if they are exposed, to inform our admiralty codes and findings.

Barnhart, Michael. “Exposing DPRK Cyber Syndicate and Hidden IT Workforce.” DTEX Systems, 14 May 2025, [https://reports.dtexsystems[.]com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf].

Choi, Hee-jin. “Kim Il-Sung University Also Learns ChatGPT… North Korea Is Working Hard to Acquire AI Technology.” SBS News, 22 Feb. 2022, [https://news.sbs.co[.]kr/news/endPage.do?news_id=N1007994483].

Choi, Hyun-seok. “[Pyongyang NOW] Kim Chaek University of Technology, North Korea’s Version of POSTECH, Celebrates Its 75th Anniversary... North Korea: ‘Kim Jong-Un Values ​​Science and Technology Talent.’” Yonhap News, 27 Sept. 2023, [www.yna.co[.]kr/view/AKR20230927131600535].

Competitive Programming Hall of Fame. “ICPC 2019 World Finals.” Competitive Programming Hall of Fame, 19 Apr. 2029, [cphof[.]org/standings/icpc/2019].

Jeong, Gyo-jin. [Rodong Sinmun Magnifying Glass] “I Value Kim Chaek University of Technology the Most.,” 27 Sept. 2023, [www.spnews.co[.]kr/news/articleView.html?idxno=71053].

Jeong, Tae Joo. “N. Korea Ramps up Cyber Offensive: New Research Center to Focus on AI-Powered Hacking.” Daily NK, 12 Mar. 2025, [www.dailynk[.]com/english/n-korea-ramps-up-cyber-offensive-new-research-center-to-focus-on-ai-powered-hacking/].

Matishak, Martin. “State-Sponsored North Korean Hackers Responsible for Blitz of Attacks in 2021.” The Record - Recorded Future News, 21 Nov. 2021, [https://therecord.media/state-sponsored-north-korean-hackers-responsible-for-blitz-of-attacks-in-2021].

Посольство России в КНДР/Russian Embassy in the DPRK. “ВОЗВРАЩЕНИЕ ДЕЛЕГАЦИИ ПОЛИТЕХНИЧЕСКОГО УНИВЕРСИТЕТА 김책공업종합대학대표단 귀국 [Kim Chaek University of Technology Delegation Returns Home].” Facebook, 7 Feb. 2025, [Archived link can be found here: https://archive[.]ph/nYLJ2].

Williams, Martyn. “Kim Chaek University Ranks 8th in International Programming Contest.” North Korea Tech - 노스코리아테크, 4 May 2019, [www.northkoreatech[.]org/2019/05/04/kim-chaek-university-icpc-2019/].

Want to support more work like this? Become a paid subscriber to the OSINT Insider:

Subscribe now

There are many data sources and tools that can be invaluable when digging into the infrastructure used by threat actors, but they are not all built the same. Some have unique sources of behavioral data on IPs, some provide data that is more reliable or current than others, and some have hidden issues, like the risk of PRC surveillance by anyone who uses it. This article is here to compare these tools, their data sources/capabilities, and allow you to stay on the cutting edge with your intelligence work.

Previous Issue:

In the previous issue, we dived deep into the negative effects of platforms like Skype disappearing without any archive of their data. Allowing important digital history to be forgotten and leaving some digital crimes potentially unsolvable. We also discussed the problems of collecting data to solve this data rot issue and potential solutions to solve those problems. Read more here.

How the OSINT Industry is Shifting

This month, we also presented at OSINTCon 2025 about the future of the OSINT Industry. Our presentation contains deep insights and information that we have been gathering over the past few months about how the OSINT industry is changing, how AI/ML is being used succesfully, the pitalls of LLMs, the rise of consortiums, the shifting intelligence community landscape in the United States, new laws/regulations affecting OSINT globally, and more. This presentation is part of our ongoing effort to provide deep insights to the OSINT community, beyond surface-level information you tend to find elsewhere, and was crafted with our readers in mind:

Here's a link to the Canva slides used in the presentation as well, so you can click the links to sources/additional information found in the presentation: https://www.canva.com/design/DAGoBI2P1w0/Sijma6dG-3AJpVuPtBHPXA/view?utlId=hbb6590b4ea

Upcoming Special Edition on North Korea

We have been hard at work on additional intelligence efforts related to the North Korean ITW (IT Worker) threat. We have finished writing up our new intelligence into a report and will be publishing that research very soon as a special edition of the OSINT Insider.

Thank You

We just surpassed 2,000 subscribers to the OSINT Insider! Thank you all so much for your support!

We especially want to thank all of you who have contributed financially to OSINT Insider; without your support, we simply could not justify spending so much time researching and writing this content for you. Your work also supports the development of the knowledge base, from the infrastructure, to the AI compute needed for the tech we are building to solve OSINT pain points, to administrative costs, to eventually affording staff to maintain the knowledge base itself.

If you appreciate what we do and want to support continued efforts, we invite you to become a paid subscriber.

Subscribe now

OSINT Insider Knowledge Base Reaches Milestone

The knowledge base is a key project that paid subscribers are supporting the development of, it contains 1600 reviewed tools and resources, and nearly 2000 tools/resources in total. Our priority in the first phase of this project has been to provide detailed information about every entry in the knowledge base, and thanks to the awe-inspiring work of our 2025 internship cohort, we have already surpassed 10% data enrichment of this massive database. 10’s if not hundreds of thousands of words regarding details like data sources, country of origin, search capabilities, and more were researched and written by these dedicated individuals so far.

Additionally, we introduced a well-deserved junior analyst program to offer these dedicated interns additional opportunities and experience with real case work. We will also soon be scheduling networking events for our interns, where they will be able to speak with professionals within the world of OSINT and learn about different career paths that utilize this discipline. Want to talk with these bright minds from universities like John Hopkins, Penn Sate, University of York, and others about what you do? Then reach out to us!

We still have many openings for our Content and Product Development Internship, so if you know anyone in the marketing, communications, copywriting, or adjacent fields, I would encourage you to share this exciting opportunity with them: https://www.farnsworthintelligence.com/opportunities#cntproductdevinternship (Direct Link to Internship Listing)

We also just launched a Junior Developer Internship, perfect for anyone looking to gain real development experience for their resume, so if you know anyone in the software development or computer science fields, I would encourage you to share this exciting opportunity with them: https://www.farnsworthintelligence.com/opportunities#jnrdevinternship (Direct Link to Internship Listing)

Find out about our other internship opportunities here: https://www.farnsworthintelligence.com/opportunities

Today’s Post, Important Note

Without further ado, today’s post. As a sneak peek at what we are building with this knowledge base, I decided to write MUCH longer descriptions that reflect the depth of information on these tools in our knowledge base. These very long and detailed descriptions are available for the first 10-20 tools, but since we know many of you come here to find new and unique tools/resources, we also included the full list of our collection for this category for paid subscribers. Which includes 40+ tools from unique sources of IP information using PCAP files to super-fast directory busting tools that beat dirbuster in a race any day.

IP Investigation Toolbox

🔗 URL: https://cipher387.github.io/domain_investigation_toolbox/ip.html
🛡️ Defanged: [https://cipher387[.]github[.]io/domain_investigation_toolbox/ip[.]html]

• Summary: Simplistic tool for gathering information about IP addresses through 15 linked OSINT tools (e.g., Shodan, Censys).

• Cost: Free

• Data Available: This tool links to results from:

  • Censys.io

  • Shodan.io

  • Bgp.he.net

  • Bgp.tools (Prefix)

  • Spyse.com

  • Myip.ws

  • Threatcrowd.org

  • Ipv4info.com

  • Grayhatwarfare (Files)

  • Maltiverse (malware reports)

  • ThreatMiner

  • Natlas.io

  • Check-host.net

  • iplocation.net

  • ip2location.com

• Search By:

  • IP Address only (IPv4 and IPv6)

• Other Important Details:

  • The tool does not display the results itself, but provides buttons to go directly to the results page of each listed tool for the provided IP address.

  • This page/tool was last updated two years ago, however, most of the 15 tools linked on the page still work/are online.

Cyberbro

🔗 URL: https://github.com/stanfrbd/cyberbro
🛡️ Defanged: [https://github[.]com/stanfrbd/cyberbro]

• Summary:

  • A FOSS self-hosted platform for cyber threat intelligence research on indicators of compromise (IP address, file hash, etc). Supports a wide variety of unique and powerful features, including support for Chrome Extension ID lookups, a vast selection of data sources, multiple graphical view options, EDR and CTI platform integrations, automated comprehensive reports, caching, proxying, multi-threading, and more!

    

    

• Cost: Free, some data sources require an API key to integrate them into this tool and require you to pay for said API key/access.

• Data Available:

  • Pools results from these sources into one interface:

    • AbuseIPDB

    • Abusix

    • Alienvault

    • Github

    • Google

    • Google common DNS records

    • Hudson Rock

    • IPquery

    • MISP (demo from @CIRCL - TLP:CLEAR)

    • Phishtank

    • Reverse DNS

    • RDAP (ex Whois)

    • Shodan

    • Spur.us

    • ThreatFox

    • URLscan

    • VirusTotal

• Search By:

  • IP Address

  • Domain Name

  • File Hash

  • Chrome Extension ID

  • Or bulk upload IoCs/selectors (plain text, separated, HTML, JSON, CSV, log data, garbage data, fanged data [.] [dot] hxxp, etc.)

• Other Important Details:

  • Self-Hosted: The software can be tested via the free demo page and self-hosted locally on your machine.

  • Easy Input: Paste raw logs or IoCs—automatic parsing and extraction.

  • Multi-Service Checks: Reputation lookup for IPs, hashes, domains, URLs, and Chrome extension IDs across many threat intel services.

  • Comprehensive Reports: Advanced search, filtering, and export to CSV/Excel.

  • Fast Processing: Multithreaded for speed.

  • Automated Pivoting: Discover related domains, URLs, and IPs via reverse DNS and RDAP.

  • Accurate Domain & Abuse Info: ICANN RDAP and abuse contact lookups.

  • Integrations: Microsoft Defender for Endpoint, CrowdStrike, OpenCTI, Grep.App, Hudson Rock, and more.

  • Proxy & Storage: Proxy support and results are stored in SQLite.

  • History & Graphs: Analysis history and experimental graph view.

  • Cache: Caching for faster repeat lookups (enabled at multi-engines level, not each engine).

  • The lead developers/contributors are actively maintaining and improving this project as of this article’s writing.

Advertisement/Promotion

infostealers.info

🔗 URL: https://infostealers.info/invite/712CAE1F

🛡️ Defanged: [https://infostealers[.]info/invite/712CAE1F]

• Summary: Infostealer data is the new breach data, with billions of records publicly accessible online; it’s nonsensical not to make use of this powerful new OSINT data source. And unlike breach data, which only reveals a single record from a single company, infostealer data is a subject’s entire digital footprint. Every website they saved a password to, the URL of every website that stored a cookie on their device (yes, even those ones), the names of their files and folders, their saved payment methods, and autofill data, it’s a treasure trove for digital investigators. And when you get a hit, the case is over, you have everything you need. Use it to identify users of CSAM distribution websites or cybercrime forums, use it to find the smoking gun for your high-dollar divorce case, the potential is truly unlimited with this new datasource. Sign up for infostealers.info today and get 3 free demo searches!

• Cost: $1 per credit (most searches only cost 1 credit per search)

• Data Available:

  

  • Saved passwords and logins from the browsers of over 50 million devices around the world (also contains the URL the password was saved too)

• Search By:

  • Phone Number

  • Email Address

  • Username

  • Domain

  • Password

  • COMP ID (Gets all of the data from a specific device)

• Other Important Details:

  • The full platform provides additional data from infostealer logs in search results, such as stored cookies (acts as a pseudo browsing history), autofill data (can include addresses), saved payment methods (credit cards), and system information (file tree). You can also export the raw contents of the logs, which can contain even more data like actual browsing history, desktop screenshots, installed programs, cryptowallet information, and more. And you can search using more advanced search features, including keyword searches (with boolean and wildcard support), searches of credit card numbers, file/folder name search, and more! Learn more about the full platform here, and reach out for a trial: https://www.farnsworthintelligence.com/infostealer-data

    

    
    

    Sign Up For Free Demo

Prerequisite Knowledge Before Continuing:

There is some basic required knowledge to understand the capabilities of the internet-asset searching tools listed below. Specifically, you need to understand how they collect information about the “technologies” or “services” they catalogue. This information is collected through what is known as a banner.

This is an explanation of a banner and what it contains from Shodan:

FOFA

🔗 URL: https://en.fofa.info/
🛡️ Defanged: [https://en[.]fofa[.]info/]

• Summary: Chinese-based CTI cyberspace asset search engine designed for mapping the global internet landscape. It actively detects IoT devices— both hardware and software— utilizing an extensive database of over 350,000 fingerprints. Use with caution and don’t provide any sensitive information, however, as the company is subject to PRC surveillance.

• Cost: Freemium

• Data Available:

  • Banner Information

  • Fingerprint-based Products List (Ex: Kubernetes, Linux, etc)

  • Open Ports/Services

• Search By:

  • IP Address

    • Supports batch search up to 100 at a time, and IP ranges via batch search

  • Domain Name

    • Supports batch search up to 50 at a time

  • Icon (Favicon/.ico)

  • Full-text/keyword search (finds matches in banner information)

• Other Important Details:

  • The parent company of this platform is called “Beijing Huashun Xin'an Technology Co., Ltd.” and its office address is listed as: 11th Floor, Building C, Hehua Mingcheng Building, No. 7 Jianguomen South Street, Dongcheng District, Beijing. By Chinese law, all Chinese companies are subject to surveillance by the Chinese government, and all of their data is accessible to the PRC. Because of these laws, it is ill-advised to use this tool for anything classified or confidential.

  • The Chinese version of the platform includes a “Data Rewards Program”, which is described as this when translated from Simplified Chinese:

    • “FOFA invites white hat masters to build a data map and submit the assets not found by FOFA.

      Once the submission is automatically redeemed for F-point, any questions can be contacted by Fofabot.”

  • The parent company of FOFA is a Beijing-based cybersecurity and asset monitoring company. Its’ customer base includes some notable Chinese companies:

    

Spur

🔗 URL: https://spur.us/context-api/
🛡️ Defanged: [https://spur[.]us/context-api/]

• Summary: Identifies anonymization (e.g., VPNs, mobile proxies, residential proxies, etc.) networks tied to IP addresses. We used this tool when investigating some of the North Korean IPs that we gathered for our report on North Korean ITW farms.

• Cost: Freemium Model

  • Data Available:

    • Real-time identification/behavioral information about IP addresses:

      • VPNs tied to a specific IP

        

      • Residential proxies tied to a specific IP

        

      • Behaviors tied to a specific IP

        

• Search By:

  • IP Address (IPv4 or IPv6)

• Other Important Details:

  • You can also purchase raw data feeds that can be used for searches other than search by IP, such as historical records, searching all the IPs available for a single anonymity service on a given day, or all of the infected IPs contributing to a malware proxy service.

  • Spur collects its data by signing up for VPN/Proxy services and collecting the exit/entry IPs directly from them. Meaning the data is much more reliable and verbose than the labels by IPInfo, for example.

StopForumSpam

🔗 URL: https://www.stopforumspam.com/usage
🛡️ Defanged: [https://www[.]stopforumspam[.]com/usage]

• Summary: A free service that records reports of spam on forums, blogs, and wikis and provides the data back to those sites via integrations. Often used to detect potential spammers at the new user registration step or at other events, such as a new post. Effectively serves as a universal blacklist for spammers; used on over 200,000 sites.

• Cost: Free

• Data Available:

  • Each report in their database can contain the following information:

    • Date of Report

    • IP Address

    • Email Address

    • Username

    • Country

    • Some records also contain an evidence report, which provides additional details like spam count, explanation of how they were caught/were spamming, last seen date, etc.

      

• Search By:

  • This tool uses a Google CSE to support full-text/keyword search of all reports on the site, so you can search for anything that could be in the reports (refer to the data available section). Relevant supported selectors include:

    • IP Address (IPv4 Only)

    • Email Address

    • Username

• Other Important Details:

  • Nothing to note.

WebCheck

🔗 URL: https://web-check.xyz/
🛡️ Defanged: [https://web-check[.]xyz/]

• Summary: All-in-one website investigation tool designed for comprehensive analysis. Performs over 30 checks, looking at IP information, SSL chain, DNS records, cookies, headers, and more. Web Check is available as a hosted version, and it can be deployed locally via Docker or source code.

• Cost: Free

• Data Available:

  • Pulls the following data points based on URL:

    • IP Info

    • SSL Chain

    • DNS Records

    • Cookies

    • Crawl Rules

    • Headers

    • Quality Metrics

    • Server Location

    • Associated Hosts

    • Redirect Chain

    • TXT Records

    • Server Status

    • Open Ports

    • Traceroute

    • Carbon Footprint

    • Server Info

    • Whois Lookup

    • Domain Info

    • DNS Security Extensions

    • Site Features

    • HTTP Strict Transport Security

    • DNS Server

    • Tech Stack

    • Listed Pages

    • Security.txt

    • Linked Pages

    • Social Tags

    • Email Configuration

    • Firewall Detection

    • HTTP Security Features

    • Archive History

    • Global Ranking

    • Block Detection

    • Malware & Phishing Detection

    • TLS Cipher Suites

    • TLS Security Config

    • TLS Handshake Simulation

    • Screenshot of Website

      

• Search By:

  • URL

• Other Important Details:

  • Nothing of note.

Netlas.io

🔗 URL: https://app.netlas.io/host/
🛡️ Defanged: [https://app[.]netlas[.]io/host/]

• Summary: Netlas.io is positioned as an internet scanning and search engine platform, providing data on internet-connected assets, including hosts, services, DNS records, WHOIS information, SSL certificates, etc. It caters to cybersecurity professionals, OSINT investigators, and threat intelligence analysts, offering tools for discovery, reconnaissance, vulnerability assessment, and attack surface mapping.

• Cost: Freemium Model

• Data Available:

  • WhoIS information

  • SSL certificates

  • DNS records

  • Banner responses/services

• Search By:

  • Supports advanced boolean searches using the following fields/options:

    • Note: Many of these fields are only available with a paid subscription to the website.

    • Addressing:

      • domain

      • host

      • host_type

      • IP

      • path

      • port

      • prot4

      • prot7

      • protocol

      • referer

      • target

      • uri

    • Information:

      • certificate

      • cve

      • geo

      • isp

      • jarm

      • tag

      • whois

    • Protocols:

      • amqp

      • dns

      • elasticsearch

      • ftp

      • http

      • imapmemcached

      • modbus

      • mongodb

      • mqtt

      • mssql

      • mysql

      • netbios

      • ntp

      • oracle

      • pop3

      • postgres

      • raw_tcp

      • rdp

      • redis

      • s7

      • smb

      • smtp

      • snmp

      • socks

      • ssh

      • t3

      • telnet

      • vnc

    • Service fields (from Netlas themselves):

      • @timestamp

      • last_updated

      • scan_date

• Other Important Details:

  • Includes multiple paid and free datasets in their DataStore, including:

    • Free - Top 1,000 most common subdomains: A dictionary containing the top thousand of the most commonly used subdomain names sorted by frequency of use.

  • Netlas does not disclose how often they perform scans, using a vague “scans the internet from time to time” explanation. This makes it unclear how it compares to a service like Shodan, which advertises weekly internet-wide scans.

  • The number of searches and the number of results are limited for free users.

  • Includes a graphical search/discovery feature:

    

Shodan

🔗 URL: https://www.shodan.io/
🛡️ Defanged: [https://www[.]shodan[.]io/]

• Summary: A Specialized search engine for internet-connected devices. Also known as the search engine for the Internet of Things (IoT), it operates by scanning the internet, collecting service banners from open ports, and making this data searchable. It was the first search engine of its kind at launch.

• Cost: Freemium model

• Data Available:

  • Technologies identified (e.x. OpenSSH, nginx, etc)

    • Provides full data property of banner text response that was used to identify the technology on a specific port (e.x. “SSH-2.0-OpenSSH_7.4” response on port 22 to identify OpenSSH)

      

  • Open Ports

  • Vulnerabilities Identified

    • Includes the CVE

• Search By:

  • IP Address

  • Domain Name

  • Keywords in Data Field, Most Commonly Used to Search By Technology/Service (e.x. openSSH, nginx, etc)

  • Keywords in All Other Fields in Banner Response (using filters)

• Other Important Details:

  • Shodan claims to crawl the entire internet every week.

  • As part of their enterprise offerings, Shodan sells a bulk DataFeed where organizations can download all of the data that Shodan collects to build their own database of Internet-connected devices. However, it is likely (but we have not confirmed this) they would have terms to restrict this to internal use only to prevent you from creating a competing platform with their data.

  • Their enterprise offerings also include on-demand scanning, allowing you to use their infrastructure for your needs.

  • Shodan was the first internet-wide search engine of it’s kind at launch and is the most popular/well-known amongst its peers.

  • Making searches using filters (which includes any searches that search properties other than the data property from the banner response) is limited to paid users.

  • The number of results and number of searches are limited for free users.

GreyNoise Visualizer

🔗 URL: https://viz.greynoise.io/
🛡️ Defanged: [https://viz[.]greynoise[.]io/]

• Summary: Threat intelligence platform that utilizes internet-wide scanning and analyzes exploitation traffic. Differentiates between “noise” (e.g., scans from search engines, legitimate security companies, etc.) and potentially malicious scanning or targeted attack traffic. It offers fully customizable filters and visualizations. It can help analysts gain context on observed IP addresses.

• Cost: Freemium

• Data Available:

  • Note: All of the data they have is also historical in nature, you can view when events/records were logged and view a timeline of activity for a specific IP address. You can view up to the last 90 days of it for free as well.

  • rDNS

    • rDNS is short for reverse DNS, it refers to DNS records tied to the IP address. This can be used to identify domains or subdomains pointing to the IP address.

  • Actor

    • This field is a label provided by Greynoise that correlates to the threat group/actor tied to an IP address. It can be very useful information for threat intelligence research.

  • Observed Activity

    • This is data that is logged by Greynoise or other sources that provides context into the activity of the IP address. This data can then be used to identify specific malicious activity, such as: the specific script/tool the IP address is using to scan the internet for vulnerable devices, the type/specific vulnerabilities the IP address is scanning for, and even the specific vulnerabilities (and the CVE) it attempted to exploit in the wild.

      

• Search By:

  • IP Address

  • GreyNoise Query Language (GNQL)

    • GreyNoise also has its own custom query syntax, which allows you to search/filter by:

      • ip - The IP address of the scanning device IP

      • classification - Whether the device has been categorized as unknown, benign, or malicious

      • first_seen - The date GreyNoise first observed the device

      • last_seen - The date GreyNoise most recently observed the device

      • actor - The benign actor the device has been associated with, such as Shodan, Censys, GoogleBot, etc

      • tags - A list of the tags the device has been assigned over the past 90 days

      • spoofable - This IP address has been opportunistically scanning the Internet but has failed to complete a full TCP connection. Any reported activity could be spoofed.

      • vpn - This IP is associated with a VPN service. Malicious or other activity should not be attributed to the VPN service provider.

      • vpn_service - The VPN service the IP is associated with

      • bot - The IP has been associated with known bot activity

      • metadata.category - Whether the device belongs to a business, ISP, hosting, education, or mobile network

      • metadata.country OR metadata.source_country - The full name of the country the device is geographically located in

      • metadata.country_code OR metadata.source_country_code- The two-character country code of the country the device is geographically located in

      • metadata.destination_country - The full name of the IP scanning destination country

      • metadata.destination_country_code - The two-character country code of the IP scanning destination country.

      • single_destintation - A boolean parameter that filters source country IPs that have only been observed in a single destination country. This has to be used in conjunction with destination_country and destination_country_code.

      • metadata.city - The city the device is geographically located in

      • metadata.region - The region the device is geographically located in

      • metadata.organization - The organization that owns the network that the IP address belongs tometadata.rdns - The reverse DNS pointer of the IP

      • metadata.asn - The autonomous system the IP address belongs to

      • metadata.tor - Whether or not the device is a known Tor exit node

      • raw_data.scan.port - The port number(s) the devices has been observed scanning

      • raw_data.scan.protocol - The protocol of the port the device has been observed scanning

      • raw_data.web.paths - Any HTTP paths the device has been observed crawling the Internet for

      • raw_data.web.useragents - Any HTTP user-agents the device has been observed using while crawling the Internet

      • raw_data.ja3.fingerprint - The JA3 TLS/SSL fingerprint

      • raw_data.ja3.port - The corresponding TCP port for the given JA3 fingerprint

      • raw_data.hassh.fingerprint - The HASSH fingerprint

      • raw_data.hassh.port - The corresponding TCP port for the given HASSH fingerprint

        

• Other Important Details:

  • GreyNoise produces tags which is the signature-based detection method used to identify actors, tools, and CVEs in their observed activity data. These tags are tracked and using this they can provide insights on the activity of threat actors like:

    • Trends - GreyNoise classifies a tag as trending when their sensors observe a significant increase in the average number of IPs transmitting traffic within a 10-day period.

    • Anomalies - GreyNoise classifies a tag as an anomaly when its sensors observe a sudden peak in the number of IPs transmitting traffic within 10 day period.

ODIN

🔗 URL: https://search.odin.io/
🛡️ Defanged: [https://search[.]odin[.]io/]

• Summary: ODIN performs internet scanning, including port scanning, host search, vulnerability scanning, and threat assessment.

• Cost: Freemium

• Data Available:

  • Host information, including:

    • Open ports

    • Vulnerabilities (with associated CVE)

    • Tags (Anonymous proxy, CDN, Satellite Provider)

    • Services (Identified via banner responses)

      • Includes the full raw body of the banner response and extracted information

    • WhoIS Information

    • Standard IP Geolocation Information

  • Exposed Buckets/Files

    • Buckets are unstructured cloud data storage products that companies often use to host information for their apps, services, websites, etc. These buckets can often contain sensitive files that companies do not realize is open to the internet.

      • Examples of information commonly stored in buckets:

        • Attachments/Images sent via instance communication services

        • Invoices generated by delivery apps or restaurant software

        • Images/content from an e-commerce website

    • The bucket files are also indexed and tagged with potential/detected file contents, such as “financial information”.

• Search By:

  • For Host Data

    • Note: Filters for these search options include:

      • Search in ASN, Geolocation, or BGP Prefix

      • Search for exposed ports, services, products, etc.

      • Access data within a time range for different timestamp fields.

    • IP address/Host Name

    • Domain name

    • Port

    • Product/Service

    • CVE

    • CIDR/IP range

  • For Exposed Buckets Data

    • Search based on categories and labels

    • Search based on the cloud provider

    • Search based on bucket files

    • Search with time-based filters

  • For Exposed Files Data

    • Search based on the file extension, size, category and label

    • Search based on bucket and cloud provider

    • Search with time-based filters

• Other Important Details:

  • No additional information provided.

Cisco Talos Intelligence

🔗 URL: https://talosintelligence.com/
🛡️ Defanged: [https://talosintelligence[.]com/]

• Summary: Cisco's dedicated security intelligence platform for threat detection and analysis sources some unique information from Cisco’s telemetry and sensors.

• Cost: Freemium

• Data Available:

  • IP, domain, and URL reputation ratings

  • Email Volume Statistics

  • Content Category of Email/IP/Domain/URL Activity (e.x. Computers and Internet, Auction, Cryptocurrency, etc)

• Search By:

  • For both Email/Spam Reputation Data and IP/Domain Reputation Data:

    • IP

    • URL

    • Domain

    • Network Owner

    • File SHA256

• Other Important Details: No additional information provided.

IPInfo

🔗 URL: https://ipinfo.io/
🛡️ Defanged: [https://ipinfo[.]io/]

• Summary: Comprehensive IP data provider offering geolocation, anonymization label (VPN, Proxy, TOR, Data Center, etc), ASN info, and more.

• Cost: Freemium

• Data Available:

  • Geolocation

  • ASN information

  • Anonymization label

• Search By:

  • IP address (IPv4/IPv6)

  • ASN

• Other Important Details: No additional information provided.

Whoxy

🔗 URL: https://www.whoxy.com/
🛡️ Defanged: [https://www[.]whoxy[.]com/]

• Summary: WHOIS history and reverse lookup by name or email.

• Cost: Freemium

• Data Available:

  • WHOIS records, including domain name and registrar information.

• Search By:

  • Domain name

  • Owner’s name

  • Owner’s email address

  • Company name

  • Domain keyword.

• Other Important Details:

  • It can be used to identify domains owned by a person by searching via email or name.

  • Powered by Autowhois.com and Bigdomaindata.com.

  • Maintains a large historical WHOIS database, reportedly containing records for 345 million domain names.

bgp.he.net

🔗 URL: https://bgp.he.net/
🛡️ Defanged: [https://bgp[.]he[.]net/]

• Summary: ASN/IP range lookup by organization name.

• Cost: Free

• Data Available:

  • ASN details, including name, number, and peer information.

• Search By:

  • ASN number

  • IP address

  • Organization name

• Other Important Details:

  • Beyond ASN lookups, this website provides a wealth of other networking-related tools/information from a map of the global internet backbone (undersea cables, exchanges, etc): https://www.he.net/3d-map/, a global directory of internet exchanges and their exchange participants, extremely powerful and verbose traceroute tools, etc.

Want to access our entire OSINT Knowledge Base when it comes out? You can do so when you become a paid subscriber to the OSINT Insider. Let us do the heavy lifting of cataloguing OSINT tools, resources, and tips for you:

Subscribe now

Paid subscribers can also see this entire post, with an additional 40 tools/resources after this point in the post that we couldn’t add to this detailed list because we haven’t finished collecting detailed information about the tools. Want to help build our knowledge base and learn about the other 40+ tools? Come intern for us: https://www.farnsworthintelligence.com/opportunities

Read more

In the early 2000s, Skype was a revolution. Peer-to-peer encrypted calling, decentralized infrastructure, and global accessibility made it the backbone of online communication. It was used by journalists, cybercriminals, scam rings, professionals, gamers, teenage friends, online predators; you name it. And now, it’s vanishing.

Microsoft made it clear with their recent notice, Skype is being phased out in favor of Teams. Services are sunsetting next month. Old user profiles will no longer be searchable; only the users who logged in and agreed to transfer to Microsoft Teams will be searchable on Microsoft Teams. The metadata that caused my parents to tell me “the internet is forever” is vanishing. And unless we act fast, we’ll lose a piece of digital history—and vital links in countless investigations.

The Consequences of Disappearing Data

The loss of a platform like Skype is more than inconvenient. It’s catastrophic for open-source intelligence (OSINT) and for survivors of digital crimes. I want to explain why. This one is personal.

When I was 14, I was manipulated on Skype. Groomed by a predator, coerced into performing acts on camera that I didn’t understand. Once I had fully grasped what happened to me later on in life, I was left feeling ashamed, scared, and violated, with little to no recourse. It was this experience that ultimately led me down a path into the OSINT world, in hopes I could use this technology to catch these horrible people and save kids from what had happened to me. But my abusers knew what they were doing; how to stay anonymous and how to disappear. They used Skype because it was easy for a child to set up/use, and because it gave them instant access to vulnerable kids.

This sort of grooming was and is still done on many millions of kids, and the material produced by it, known as self-generated CSAM (Child Sexual Abuse Material), is usually sold to pedophiles through the dark web. Essentially, online video calling platforms like Skype, and in more recent times, Discord, are used to systematically produce CSAM from children all around the world and then sell it. It is a form of digitally assisted human trafficking done at scale.

In recent years, the problem of self-generated CSAM has become more apparent, with sadistic groups like 764 receiving mainstream attention for their exploitation of vulnerable children. Groups like 764 don’t just stop at self-generated CSAM; they groom and then extort children into producing much more sadistic material, such as self-mutilation/self-harm, bestiality/animal abuse (including against minors’ own pets), and in extreme cases, imagery of the child taking their own life. I got lucky, it could have been so much worse.

I’ve spent the last half a decade trying to make sense of what happened to me. Digging. Tracing usernames. Following aliases through breached data and old forum posts. But the only digital thread connecting back to them—their Skype handle—is going dark. And once it’s gone, so is any chance I have of proving what happened to me and that the handle ever existed at all. That’s not just a personal tragedy. That’s an investigative dead-end in a case that could still be cracked.

And I know I’m not alone. Skype was one of the most commonly used platforms for CSAM producers during the early and mid-2010s. They exploited Skype’s pervasiveness and ease of use, leveraged its video calling tools, and preyed on vulnerable kids across the world, many of whom were tricked into self-producing material that would haunt them for years. We’re not talking dozens of victims. We’re talking thousands. Maybe hundreds of thousands. And every lost profile, every unreachable handle, is vital evidence lost in a case that still matters.

But this affects more than just CSAM production and grooming victims, it affects many different crime sets:

Case Study 1: Cryptocurrency Scam Ring

Imagine a fraud group that ran investment scams from 2010 to 2012. Victims were lured into sketchy schemes via Facebook. But communication? That happened over Skype.

The scammers used unique usernames tied to fake trading firms. Years later, victims start reporting the fraud, but the money trail is cold. The Skype group was deleted, evidence wiped, and any recollection of the fraudsters’ Skype username is gone. The only shared clue? A comment buried deep under a YouTube video:

However, they don’t know if this is the same Skype alias they communicated with all of those years ago or not, and this happened so long ago that none of them have their old Skype accounts anymore (nor will any of them be able to search the messages of their old accounts after Skype shuts down)

If that alias still exists, even without access to their accounts, the data on their Skype profile sharing the same username can be found and then used to cross-reference with what they already know to confirm it’s them. From there, they can report the crime to authorities and just maybe find justice.

But if it’s gone? There’s no way to even begin that work, no way to prove this profile ever existed.

Case Study 2: Ransomware Operator Trail

Imagine a well-known ransomware group used Skype for initial outreach to victims back in the early 2010s. Payment negotiations, extortion threats, and tech support all funneled through a small group of public-facing aliases.

Flash forward a decade. That group is inactive, but some of its infrastructure becomes relevant again. A new malware variant uses old code and domains tied to the once thought to be inactive group. An email address shows up in a new campaign. The only consistent datapoint across the two groups? A Skype name last seen in 2014 is linked to both of their emails.

If that data had been preserved, it could be used to link campaigns. But when Microsoft wipes that profile, the connection dies with it.

This Effects All of OSINT

In the OSINT (Open Source Intelligence) world, platforms like OSINT Industries, Epieos, and lolarchiver offer a critical service: starting with something as small as an email address, investigators can build a surprisingly comprehensive map of a person's digital footprint—from what services they’ve signed up for, to usernames they use across platforms, even hints about where they might live.

But that map is shrinking, and every time a platform like Skype shuts down, it gets even smaller.

A Race Against Time and Platform Lockdowns

Many of these tools rely on public or semi-public data leaks, API quirks, unintended usage of features, or publicly accessible user directories. And over time, platforms catch on. They patch those holes. They lock things down. They stop returning data. And each time that happens, a piece of the digital investigation puzzle becomes permanently obscured.

An example of this happening can be found with GHUNT, a popular OSINT tool that allows you to retrieve information from Google using an email address.

Over the years, the developer of GHUNT has had to update the app multiple times as Google has slowly restricted what data can be accessed and killed certain products that used to provide data. Older versions of GHUNT used to be able to retrieve photos from public Google Photo Albums and Picasa (a now-dead Google product). They’ve also had to update it after Google restricted what information is available via Google Maps reviewer profiles.

Skype is no exception. OSINT platforms currently allow you to find someone’s Skype profile and the information within by searching for their username OR the email address/phone number connected to their account.

But soon? These platforms won’t return results for Skype. And platforms like OSINT Industries, Epieos, etc don’t archive results, so once the Skype platform is shut down, all of that data becomes dust to anyone who searches after the shutdown. No trail. No context. No evidence.

So, what’s the solution?

Here’s the playbook: Using automation (and evasion tactics like residential proxies), you systematically query platforms like Skype to find which selectors are still live. Once a profile is identified, the relevant metadata is scraped and stored: creation date, bio, associated names, country flags, friend lists, last seen timestamps, etc. Anything that might become useful later, even if it doesn't seem critical now.

But it’s not as easy as it sounds.

The roadblocks are many: aggressive rate-limiting, anti-bot systems, the costs of using residential or mobile proxies at scale, and—of course—the legal and ethical quicksand of scraping platforms that explicitly prohibit it in their terms of service.

The Technical Challenge of Saving a Platform’s Data

Preserving OSINT data isn’t as easy as hitting “download.” Especially for social/communication platforms like Skype, we face four major barriers:

1. Rate limits and bot detection
   Querying millions of profiles is expensive. Rotating residential proxies, mobile proxies, captcha solvers, headless browsers; these things all cost money and require infrastructure. And as platforms grow more hostile to scrapers due to the rise of AI and the need for training data, these challenges multiply.

2. Archival decay and takedown requests
   Even if you collect the data, storing it over time is a separate war. Archive.org, our most reliable friend, is stretched thin and underfunded. GitHub is great, but it isn’t built for long-term preservation of high-volume OSINT dumps. And once a dataset gets flagged or a court order is received? Gone.

3. Ethical and legal grey areas
   Many platforms’ Terms of Service explicitly forbid scraping, archiving, or redistributing profile data. Even if the intent is preservation or investigation, this can violate local laws, especially in privacy-heavy jurisdictions like the EU.

4. Incomplete Coverage

   We can’t expect to scrape every possible username; the total number of queries required would easily exceed trillions by the time we got to usernames eight characters or longer (More than 3,025,989,069,143,040 usernames to be exact)

Solutions (or at Least Ideas)

So, how do we fix this, or at least buy ourselves more time?

• Targeted scraping:
  Instead of trying to crawl every username possible, we can start with known selectors—emails and usernames exposed in data breaches or existing investigative datasets. These can be run against platforms like Skype to build partial but useful archives of profiles.

• Distributed storage/internet:
  Instead of uploading everything to one site, we can build mirrored repositories across centralized and decentralized platforms like GitHub, GitLab, archive.org, IPFS, BitTorrent, etc.

• Crowdsourced proxying:
  An idea inspired by BOINC, the distributed computing platform used for science, we could develop a network of volunteers who donate bandwidth for data preservation. A sort of slow, ethical residential proxy powered by community nodes. Yes, this flirts dangerously close to DDoS mechanics if misused, but with proper throttling, coordination, and respect, it could be done.

  

How OSINT Platforms Could Help

Platforms like OSINT Industries are fantastic, but they don’t save results. And they operate in the UK, meaning their privacy compliance restricts what they could legally preserve anyway.

The same is true for many other OSINT platforms, focused on scraping, searching, link analysis, and analytics. But no one is building an Archive.org for digital footprints. If these platforms could start archiving results from their tools and making them available, it could provide another historical archive of someone’s digital footprint. But even then, we need a coordinated effort with extensive coverage, not just one platform keeping track of what’s already being searched.

We’ve Done It Before — We Can Do It Again

Skype isn’t the first platform on the brink, and it won’t be the last. But we’ve seen how preservation can work; if there’s enough community willpower behind it.

Neocities: A Digital Time Capsule That Fights Back

Neocities is a spiritual successor to GeoCities. When Yahoo shut down GeoCities in 2009, nearly 38 million web pages were erased in one swoop. But volunteers jumped in. The Archive Team, an internet preservation collective, managed to scrape and preserve about 1TB of content before the plug was pulled. That archive still lives today as a browsable piece of internet history.

Neocities learned from that collapse. It encourages preservation by default. Pages are static, easily mirrored, and community-driven. In many ways, it’s the opposite of today’s walled gardens.

Google+ and the Archive Team’s Race Against the Clock

When Google+ shut down in 2019, the writing was on the wall for months. But despite the advance warning, Google didn’t offer a clean export for public pages or communities. Enter the Archive Team again. Using custom scrapers and volunteer-run infrastructure, they salvaged over 1.5 million public posts, which are still accessible through the Internet Archive.

Was it perfect? No. Private messages, niche communities, and images hosted externally were lost. But the larger lesson holds: with a distributed team and some coordination, we can preserve huge slices of the internet, even when platforms don’t want us to.

Time is Running Out

Skype shuts down on May 5, 2025. The old Skype user database will disappear completely in January 2026, with neither Skype nor anyone else possessing it. Then maybe Telegram purges inactive handles. Then, major platforms start patching the ways we collect data about people’s digital footprint. The dominoes can fall quickly.

Every time a platform dies, we lose clues. We lose evidence. And we lose the chance to bring closure to people like me, who still live with unanswered questions from when we were 14.

I may never find the people who hurt me. But I’m not ready to give up that chance for others. And I know thousands of OSINTers feel the same. We likely don’t have enough time to scrape Skype, but let the loss of this data be a lesson; we need to solve the overarching problem.

If we want truth, justice, and accountability in a world where more and more crime is digital, then OSINT data is sacred—and it must be preserved.

For my paid subscribers:

I believe this article is important to the wider industry and educates readers on a variety of relevant topics; however, I recognize that my paid subscribers may feel differently. I want to ensure those who are supporting me monetarily feel they are getting value out of my content. For that reason, I have prepared this sneak peek of our upcoming issue on tools for network-related lookups, including tools that aggregate domain, IP, certificate, cookie, and device information across the global internet for lookups:

Read more

Reverse image search tools have evolved from basic search engines to find other versions of an image online, to complex products that can perform ML-powered searches for faces, places, products, etc. Of course, we have been compiling a list of reverse image searches tools/resources and their capabilities at Farnsworth Intelligence as part of our knowledge base. Today I am releasing the extended list to my OSINT newsletter subscribers:

CopySeeker

🔗 URL: https://copyseeker.net/
🛡️ Defanged: [https://copyseeker[.]net/]

• Combines OCR (Optical character recognition) with AI/ML-powered reverse image search.

• Also has an API.

Yandex Reverse Image Search

🔗 URL: https://yandex.com/images
🛡️ Defanged: [https://yandex[.]com/images]

• Russian Search Engine.

• Often has better results for faces and photos from Russia, former-Soviet block countries, and Eastern Europe.

LensoAI

🔗 URL: https://lenso.ai/en
🛡️ Defanged: [https://lenso[.]ai/en]

• AI image search.

• Has multiple specialized models to find matches for specific things, including faces, places, duplicates, related, and similar images.

TinEye

🔗 URL: https://tineye.com/
🛡️ Defanged: [https://tineye[.]com/]

• Often has different results than major search engines.

• Performs pixel-to-pixel comparison, which often provides better results at finding the original source of images.

• Has unique solutions for businesses like:

  • WineEngine, a computer vision-based wine label scanning API used to identify wine, beer, whisky, and all spirit labels.

  • Automated image tracking to continuously track where a company’s proprietary images or logos are appearing online.

Baidu Reverse Image Search

🔗 URL: https://image.baidu.com/
🛡️ Defanged: [https://image[.]baidu[.]com/]

• Chinese Search Engine.

• Often has better results for China and surrounding countries/region.

Sogou Reverse Image Search

🔗 URL: https://pic.sogou.com/
🛡️ Defanged: [https://pic[.]sogou[.]com/]

• Chinese Search Engine.

• Often has better results for China and surrounding countries/region.

• Also has better people/face results for people of Asian complexion.

Google Reverse Image Search

🔗 URL: https://images.google.com/
🛡️ Defanged: [https://images[.]google[.]com/]

• Powered by a major search engine.

• Has limited results for pictures of people.

EveryPixel

🔗 URL: https://www.everypixel.com/
🛡️ Defanged: [https://www[.]everypixel[.]com/]

• Stock Image Search Engine.

• Search across 50 leading stock image agencies at once.

• Both free and paid stock images.

• It can also be searched by text description/keywords if you do not have an image.

Lexica

🔗 URL: https://lexica.art/
🛡️ Defanged: [https://lexica[.]art/]

• AI Image generator with a search tool for finding AI-generated images similar to the one provided.

• Only searches AI images generated within its platform.

SauceNAO

🔗 URL: https://saucenao.com/
🛡️ Defanged: [https://saucenao[.]com/]

• Reverse image search engine designed for finding sources of adult content from an image or a screenshot.

Bing Reverse Image Search

🔗 URL: https://www.bing.com/images/feed
🛡️ Defanged: [https://www[.]bing[.]com/images/feed]

• Powered by a major search engine.

WIPO Global Brand Database

🔗 URL: https://branddb.wipo.int/en/similarlogo
🛡️ Defanged: [https://branddb[.]wipo[.]int/en/similarlogo]

• Helpful for identifying logos, graphics, etc from brands/companies.

ASCII2D

🔗 URL: https://ascii2d.net/
🛡️ Defanged: [https://ascii2d[.]net/]

• Japanese Image Search Engine.

• Specifically helpful for Anime, Mature Animated Content (Especially in Japanese style/of Japanese origin), and user-created adult only content on image-boards.

Search-By-Image

🔗 URL: https://github.com/dessant/search-by-image
🛡️ Defanged: [https://github[.]com/dessant/search-by-image]

• Chrome extension to make reverse image searching easier.

• Right-click an image and search it in multiple sites/tools at the same time.

KarmaDecay

🔗 URL: http://karmadecay.com/
🛡️ Defanged: [http://karmadecay[.]com/]

• Reverse image search images on Reddit to find when they were first posted on Reddit.

• Helpful for examining karma farming on Reddit.

Want to access our entire OSINT Knowledge Base when it comes out? You can do so when you become a paid subscriber to the OSINT Insider. Let us do the heavy lifting of cataloguing OSINT tools, resources, and tips for you:

Get 20% off for 1 year

We are offering a 20% discount to new subscriptions for a limited time to celebrate the launch of the newsletter, get it while it lasts!

Paid subscribers can also see this entire post, with an additional 10 tools/resources after this point in the post.

Read more

In this edition of the OSINT Insider, you’ll get a deep dive into powerful honeypot tools/techniques for tracking someone’s location, including breakdowns of the different capabilities, use cases, and an in-depth tutorial. You’ll also get valuable insights from a compliance expert on the laws and regulations affecting honeypots such as GDPR and CCPA.

“So, you want to come to the darkside heh!?”

OSINT is typically seen as an entirely passive intelligence discipline. In the past when I’ve suggested the idea of using a honeypot to get information directly from a subject, I’ve often been verbally lambasted. And to the credit of the TraceLab judges who drill this into volunteers’ skulls, you're right, for those novice or new OSINTers, these techniques are dangerous. However, I hope to provide enough information in this article to explain not just how to do this, but to explain why you probably shouldn’t.

Read more

Image forensics has evolved from basic EXIF data usage to advanced methodologies that can be used to detect whether a photo's been edited or modified. Today you can utilize techniques like Error Level Analysis, ML-powered deblurring, and deep learning anomaly detection to extract far more intelligence value from images than you ever could before. Of course, we have been compiling a list of image forensic tools/resources and their capabilities at Farnsworth Intelligence as part of our knowledge base. Today I am releasing the extended list to my OSINT newsletter subscribers:

EXIFMeta

🔗 URL: https://exifmeta.com/
🛡️ Defanged: [exifmeta[.]com/]

• Free Online EXIF & Metadata Viewer.

• Get device information: model, manufacturer, etc.

• GPS data: latitude, longitude, altitude, etc.

• Capture information: flash settings, aperture, shutter speed, lens type, focal range, etc.

• Displays name and copyright data.

• Extracts additional metadata from images.

Forensically Beta

🔗 URL: https://29a.ch/photo-forensics/#forensic-magnifier
🛡️ Defanged: [29a[.]ch/photo-forensics/#forensic-magnifier]

• Tool for forensic analysis of images.

• Modules included:

  • Magnification

  • Clone Detection

  • Error Level Analysis

  • Noise Analysis

  • Level Sweep

  • Luminance Gradient

  • Principal Component Analysis

  • Meta Data

  • Geo Tags

  • Thumbnail Analysis

  • JPEG Analysis

  • String Extraction

• Has a detailed help page with explanations, tutorials, and more.

FotoForensics

🔗 URL: https://fotoforensics.com/
🛡️ Defanged: [fotoforensics[.]com/]

• Tool for forensic analysis of images.

• Modules included:

  • Digest

  • Error Level Analysis

  • Hidden Pixels

  • ICC+ (Color Profile Emulation)

  • JPEG % Estimator

  • Meta Data

  • Strings

  • Source

Image Matching WebUI (IMCUI)

🔗 URL: https://github.com/Vincentqyw/image-matching-webui
🛡️ Defanged: [github[.]com/Vincentqyw/image-matching-webui]

• Efficiently matches image pairs by extracting points in images.

• Uses multiple image matching algorithms.

• Features a Graphical User Interface (GUI) designed using Gradio.

Image Verification Assistant

🔗 URL: https://mever.iti.gr/forensics/
🛡️ Defanged: [mever[.]iti[.]gr/forensics/]

• Tool for forensic analysis of images.

• Includes modules for:

  • OMGFuser algorithm

  • MM-Fusion algorithm

  • TruFor algorithm

  • OW-Fusion algorithm

  • Double JPEG quantization inconsistencies (DQ)

  • JPEG Ghosts (GHOST)

  • JPEG blocking artifact inconsistencies (BLOCK)

  • Error Level Analysis (ELA)

  • Median filtering noise residue (MEDIAN)

  • High frequency noise (WAVELET)

  • CAGI-Inversed

  • Splicebuster

  • CMFD

  • CAGI

  • DCT

  • Mantranet

  • Noiseprint

  • Metadata Analysis

• Includes detailed example cases, explanations of methods, and links to relevant academic studies/papers for various methodologies used.

Rainbolt Photoshop Tip

🔗 URL:

🛡️ Defanged: [https://youtu[.]be/Ue94gpWqEkM?si=ikJz77EljyIQnFYO&t=90]

• Tip by Rainbolt.

• 90 seconds into the video, he explains how to restore raw uncropped images in Photoshop for .dng files.

StolenCameraFinder

🔗 URL: https://www.stolencamerafinder.com/
🛡️ Defanged: [www[.]stolencamerafinder[.]com/]

• Search the web for photos taken with a specific camera.

• Uses the camera's serial number stored in the image's EXIF data.

• Helpful for locating stolen cameras.

• Can also link photos taken with the same camera from across the internet.

Steganography Online

🔗 URL: https://stylesuxx.github.io/steganography/
🛡️ Defanged: [stylesuxx[.]github[.]io/steganography/]

• Basic FOSS tool for encoding a message into an image.

• Can also decode images encoded with this tool.

• A niche tool, unlikely to be useful in most situations.

Aperi'Solve

🔗 URL: https://www.aperisolve.com/
🛡️ Defanged: [www[.]aperisolve[.]com/]

• Online platform that performs layer analysis on images.

• Uses multiple tools for deeper analysis, including:

  • zsteg

  • steghide

  • outguess

  • exiftool

  • binwalk

  • foremost

  • pngcheck

  • strings

Depix

🔗 URL: https://github.com/spipm/Depix
🛡️ Defanged: [github[.]com/spipm/Depix]

• Technique to recover plaintext from pixelized screenshots.

• Works only on pixelized images created with a linear box filter.

• Requires knowledge of the editor, website, or app where the screenshots were taken.

• Test data must be made with the same font, text size, and colors as the original.

MAXIM

🔗 URL: https://huggingface.co/google/maxim-s3-deblurring-realblur-r
🛡️ Defanged: [huggingface[.]co/google/maxim-s3-deblurring-realblur-r]

• AI model for unblurring photos.

• Used by many major AI unblur tools found online.

Memery

🔗 URL: https://github.com/deepfates/memery
🛡️ Defanged: [github[.]com/deepfates/memery]

• Search over large image datasets using natural language and computer vision.

• Allows natural language search over local images.

• Example: Search for "a line drawing of a woman facing to the left" and get relevant results.

EXIF Viewer Pro

🔗 URL: https://chromewebstore.google.com/detail/exif-viewer-pro/mmbhfeiddhndihdjeganjggkmjapkffm
🛡️ Defanged: [chromewebstore[.]google[.]com/detail/exif-viewer-pro/mmbhfeiddhndihdjeganjggkmjapkffm]

• Chrome extension that can be used on photos on a page while staying on the page.

• Includes modules for:

  • Shutter speed

  • Aperture

  • Focal length

  • Exposure mode

  • Exposure metering

  • Sensitivity

  • White balance

  • Picture control

  • Image quality

  • Lens

  • EXIF data

  • Histogram

  • And more!

ImageIdentify

🔗 URL: https://www.imageidentify.com/
🛡️ Defanged: [www[.]imageidentify[.]com/]

• Uses Wolfram's deep neural networks to identify what is in an image.

ImageAmigo Deblur

🔗 URL: https://imageamigo.com/deblur/
🛡️ Defanged: [imageamigo[.]com/deblur/]

• Removes motion blur and other sources of blur from an image.

• Uses techniques from the paper at arXiv:1612.02177.

• Incorporates DeblurGAN-v2 and DeblurGAN.

Want to access our entire OSINT Knowledge Base when it comes out? You can do so when you become a paid subscriber to the OSINT Insider. Let us do the heavy lifting of cataloguing OSINT tools, resources, and tips for you:

Get 20% off for 1 year

We are offering a 20% discount to new subscriptions for a limited time to celebrate the launch of the newsletter, get it while it lasts!

Paid subscribers can also see this entire post, with an additional 7 tools/resources after this point in the post.

Read more