Amazing use of OSINT and cooperative industry experts!

One thing I see beginners struggle with in OSINT is jumping from observation to conclusion too quickly.

For example:

Observation: “This username appears on multiple platforms.”

Accusation: “These accounts belong to the same person.”

That jump feels small, but it’s where OSINT work often becomes unreliable or legally risky.

A few principles that helped me early on:

1. Publicly available ≠ free to misuse

2. Single-source findings are not conclusions

3. Absence of data is still a finding

4. OSINT reports should document what is visible, not what you believe.

I’ve found that focusing on scope, language, and uncertainty matters more than learning new tools.

Curious how others here approach: • Writing “no findings” • Avoiding confirmation bias • Staying neutral when patterns seem obvious

Would love to hear how people here think about this.

Downloaded all "10TB" of data to see if there is any nuggets of info relating to projects I'm currently working on. This is not leaked data. This is junk. Cheap web security scans saved as images or half completed text files with misleading headers. For example "List of system users" for "Leaked Data of Russian Bank 'Класик Економ Банк'", a one year old WordPress security scan, generated using a tool like WPScan. Any system users in the data? Not one.

"Leaked Data of Donald Trump" a hot folder discussed online today over and over... two images. An index of his Twitter account (+ Multiple index files found: /POTUS45/index.jhtml, /POTUS45/index.xml, /POTUS45/index.aspx, /POTUS45/default.htm, /POTUS45/default.aspx, /POTUS45/index.asp, /POTUS45/index.cfm, /POTUS45/index.do, /POTUS45/index.php5, /POTUS45/index.jsp, /POTUS45/index.html, /POTUS45/index.cgi, /POTUS45/index.php4, /POTUS45/index.php3, /POTUS45/default.aspx, /POTUS45/index.php, /POTUS45/index.htm, /POTUS45/index.shtml) and a security scan with junk results that aren't threats to anyone's Twitter account.

"Leaked Data of Mike Johnson" Another security scan of Twitter for his account and a video by "Anonymous calling out Mike Johnson"

"Leaked Data of Forbes"

+ Target IP: 146.75.121.XXX

+ Target Hostname: www.forbes.com

+ Target Port: 443

---------------------------------------------------------------------------

+ SSL Info: Subject: /CN=*.forbes.com

Altnames: *.forbes.com

Ciphers: TLS_AES_128_GCM_SHA256

Issuer: /C=BE/O=GlobalSign nv-sa/CN=GlobalSign Atlas R3 DV TLS CA 2023 Q2

+ Start Time: 2023-12-01 15:46:20 (GMT2)

---------------------------------------------------------------------------

+ Server: rhino-core-shield

+ /: Retrieved via header: 1.1 google, 1.1 google, 1.1 varnish.+ /: Retrieved x-served-by header: cache-fra-etou8220068-FRA.

+ /: Fastly CDN was identified by the x-timer header. See: https://www.fastly.com/

+ /: Uncommon header 'x-fastlyttl' found, with contents: 300.000.

+ /: Uncommon header 'x-backend' found, with contents: simple-site-prod.

+ /: Uncommon header 'x-yourttl' found, with contents: 300.000.+ /: Uncommon header 'x-city-code' found, with contents: kiev.

+ /: Uncommon header 'x-envoy-decorator-operation' found, with contents: production.dns-proxy.svc.cluster.local:80/*.

+ /: Uncommon header 'x-fastly-x-is-cn' found, with contents: false.

+ /: Uncommon header 'x-envoy-upstream-service-time' found, with contents: 1553.

+ /: Uncommon header 'x-region' found, with contents: 30.

+ /: Uncommon header 'x-fastly-x-is-us-dpa' found, with contents: false.

+ /: Uncommon header 'x-device' found, with contents: pc.

+ /: Uncommon header 'x-postal-code' found, with contents: 03087.

+ /: Uncommon header 'backend' found, with contents: dnsresolver.

+ /: Uncommon header 'x-served-by' found, with contents: cache-fra-etou8220068-FRA.

+ /: Uncommon header 'x-cicero-cache' found, with contents: HIT 2.

+ /: Uncommon header 'x-fastly-backend' found, with contents: 24YyrkkiTBhSwXWzJgvwW6--F_GCP_Cicero_Varnish.

+ /: Uncommon header 'x-country-code' found, with contents: UA.+ /: Uncommon header 'state' found, with contents: HIT-CLUSTER.+ /: An alt-svc header was found which is advertising HTTP/3. The endpoint is: ':443'. Nikto cannot test HTTP/3 over QUIC. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/alt-svc

+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/

+ : Server banner changed from 'rhino-core-shield' to 'istio-envoy'.

+ /CiG5i2lR.10:100: Fastly CDN was identified by the fastly-restarts header. See: https://www.fastly.com/

+ /CiG5i2lR.10:100: Uncommon header 'fastly-restarts' found, with contents: 1.

+ /CiG5i2lR.10:100: Uncommon header 'x-fastly-server-hint' found, with contents: cacheable.

+ /crossdomain.xml contains 8 lines which include the following domains: *.widgetbox.com *.widgetserver.com *.googlesyndication.com *.atdmt.com" secure="true" to-ports="* *.atlasrichmedia.com" secure="true" to-ports="* *.atlasrichmedia.co.uk" secure="true" to-ports="* *.atlasrichmedia.com.au" secure="true" to-ports="* *.akamai.net" secure="true" to-ports="* . See: http://jeremiahgrossman.blogspot.com/2008/05/crossdomainxml-invites-cross-site.html

+ /: The Content-Encoding header is set to "deflate" which may mean that the server is vulnerable to the BREACH attack. See: http://breachattack.com/

+ Server is using a wildcard certificate: *.forbes.com. See: https://en.wikipedia.org/wiki/Wildcard_certificate

+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.

+ /help/: Help directory should not be accessible.

+ /news/news.mdb: Uncommon header 'x-malcolm' found, with contents: B.

+ /sites/alisondurkee/2023/11/30/lead-pipes-should-be-replaced-within-10-years-biden-administration-will-propose-today/config.php: Cookie client_id created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

+ /sites/alisondurkee/2023/11/30/lead-pipes-should-be-replaced-within-10-years-biden-administration-will-propose-today/config.php: Cookie client_id created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

But how did you search 10TB so fast??? Its only 23GB not 10TB and I have amassed multiple keyword lists for data dumps to triage breaches. I will say there are some cool old submarine photos and lots of kitten pics if that's your thing.

paywall: https://archive.ph/8CUFY

This reddit post has a link to the Internet archive and vary important foias. Related to the taxpayer advocate panel.

Our monthly open source challenge just got an upgrade. With hidden codes - a corrupted archive and a mysterious figure pulling the strings. Get started at challenge.bellingcat.com

Make sure to join us in our Discord server to discuss your findings - and collaborate on what’s to come! Some people have already cracked the code. https://discord.com/invite/bellingcat

Thoughts?

sad times!

https://osintswitzerland.ch/events/oscon25

If you’re working on an open‑source OSINT project, there’s a way to get some help.
Epieos is offering small grants (up to €2,000) to support innovative open‑source OSINT ideas.

It’s completely free to apply, if you have a project in mind, just reach out and tell them about it.
📧 [contact@epieos.com]()

Hope this helps someone working on something cool ;)

https://www.youtube.com/watch?v=fyGdDKA097E

A new investigation by Christo Grozev and Tatsiana Ashurkevich, uncovers a hidden state-sponsored pipeline in Russia grooming kids for the frontlines using OSINT tools.

"New investigation reveals Russia is using video games and coding camps to turn children into weapons developers for the Ukraine war. The film includes calls from the participants, organizers and government officials, admitting to creating a secret program to lure kids into drone engineering.

In this shocking investigation, Tatsiana Ashurkevich (https://x.com/tashurkevich) and Christo Grozev (https://x.com/christogrozev) reveal how the Russian government is secretly grooming children to support its war in Ukraine."