1. Strategy & Governance: OPSEC and Ethical Frameworks

OPSEC Review: AI and Private Data Exposure

• Meta Data Usage: Meta is reportedly utilizing user prompts entered into its AI models for the purpose of targeted advertising. This practice raises concerns regarding the privacy of investigative queries.
• LLM Prompt Subpoena Risk: The Department of Homeland Security (DHS) in the United States previously issued a warrant to OpenAI requiring the sharing of user data, including ChatGPT prompts.
  • Recommendation: Investigators utilizing large language models (LLMs) for OSINT should employ a dedicated sock puppet account to isolate these prompts and mitigate exposure risks.

Ethical Dilemma Case Studies and Legal Compliance

• OSINT Misuse: Open-source intelligence is available to all parties, highlighting a potential dark side where the same tools and techniques can be leveraged for malicious purposes, such as swatting, stalking, and arson. Analysts must consider how their information creation and sharing might be misused.
• Data Breach Compliance: When conducting reverse lookups and accessing exposed data, utilizing aggregated checks is essential to ensure compliance with privacy regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Direction: Process Over Collection

• A strategic perspective emphasizes that OSINT should be defined by its **outcome** rather than merely the collection of data or the use of tools. This view addresses collection fatigue and promotes structured analysis.

2. Collection Modalities Deep Dive: Tools and Techniques

Infrastructure and Web Reconnaissance

• WebRecon: A multi-tool designed for penetration testers and cybersecurity professionals automates several key collection processes:
  • Web crawling and data extraction.
  • Technology stack detection.
  • Email harvesting, DNS intelligence, and WHOIS lookup.
  • Historical analysis via the Wayback Machine, with professional JSON reporting.

Dorking Drill and Foundational Skills

• Passive OSINT Dorking: Core Google search operators remain fundamental to structuring complex investigations. This includes the use of `site:` and `filetype:` operators to narrow search parameters.

Email OSINT: Lookups and Pivoting

• Directional Search Distinction: OSINT distinguishes between two types of email search:
  • Email Lookup (Discovery): Starts with non-email data (e.g., name, company, domain) to identify an associated email address.
  • Reverse Email Lookup: Starts with an email address to find associated information (e.g., owner, linked accounts, breach records). This is often the preferred method for investigators due to the high data yield.
• Manual Pivoting Methods: Extracting the local part (username stem) before the ‘@’ sign allows for pivoting across platforms and providers. Techniques include running searches on the extracted username, attempting alternate provider swaps (e.g., Gmail, Yahoo), and generating plausible username variants using delimiters or platform suffixes.
• China OSINT Tips: Keyword searching may be insufficient for China-related OSINT. A suggested tactic is to generate and monitor a list of every infrastructure company in China that conducts overseas business, specifically monitoring their news and social media feeds.

3. Verification & Integrity Report: Validation and Data Leak Analysis

Email Validation Protocol

To prevent chasing dead leads, validating an address is crucial. The methods vary in invasiveness:

• Syntax Check: Confirms the address follows the basic “name@domain.com” structure.
• Mail Exchange (MX) Lookup: Essential for verifying that the domain associated with the email exists, confirming that a mail server is in place.
• SMTP/TCP Handshake: A deeper probe to determine if the mailbox is accepted by the server. This method carries a risk of triggering abuse filters.
• Confirmation Email: The definitive validation method (response confirms legitimacy), but also the most dangerous as it alerts the target to the investigation.

Data Breach Monitoring and Tooling

• BF Database Search: A tool available to look up usernames previously active on Breach Forums, returning associated information such as email addresses and IP addresses.
• Data Leak Analysis: Strategies for tracking global data leaks involve identifying leak sources, leveraging search engines and APIs to access information while available, and implementing ongoing monitoring as data is distributed across different channels.

4. Applied Intelligence Briefing: Investigative Case Studies

Process-Driven Investigations

• Case Study: OSINTing the OSINTers: A passive OSINT investigation demonstrating how complex cases can be approached using the intelligence cycle and structured analysis techniques. The case highlights that mastery of process is often more important than relying on tradecraft or tools alone.

Investigative Success Stories

• Email Pivot and Validation: An example investigation demonstrated the successful use of email OSINT in validating a target.
  • Initial Input: The email address g.bush.art@bushcreative.co was the starting point.
  • Process: A reverse search yielded a breach record with the username ‘gbush.art’ and a public Strava account. MX lookup and SMTP probing confirmed the address was live and accepted mail.
  • Outcome: Extracting the username stem ‘gbush.art’ led to a hit on DeviantArt with matching branding, validating the artist’s existence.

5. The OSINT Frontier & Dev: AI Integration and New Tools

AI Integration Updates

• AI-Powered Geolocation: GeoVLM: A web application is available that uses AI to predict the geolocation of where any uploaded image was taken, requiring no setup or payment.
• AI for Open-Source Tool Development: A process for improving open-source tools, such as those on GitHub, involves using an Integrated Development Environment (IDE) to put the entire repository into a workspace. This method enables AI-assisted debugging and the addition of new features and functionality.

New Tools and Efficiencies

• Vehicle AI: A web application that identifies the make, model, and year range of a vehicle. It functions effectively for external vehicle images but generates errors when analyzing interior vehicle images.
• DocuFinderJS: A domain scanning tool on GitHub designed to quickly uncover publicly accessible documents (e.g., PDFs, spreadsheets) across a target domain, which helps identify sensitive data exposure.
• OSINT Bookmarklets: A collection of browser bookmarklets providing various utilities, including a tool specifically useful for conducting OSINT on Facebook Marketplace users.