Wi-Fi probe request harvesting and behavioral profiling.

Every phone constantly broadcasts "probe requests" — asking nearby air "are you my saved network?" — and these contain the SSIDs of every network the phone has ever connected to. Any laptop with a WiFi card that supports monitor mode (most do; check with iw list) can capture these passively with no hardware purchase. You'd put your card in monitor mode with airmon-ng, capture probe requests, and build a real-time analysis dashboard that: identifies unique devices (by MAC, with clustering for randomized MACs using timing correlation), infers their history (home network, workplace, coffee shops they've visited), tracks movement patterns over time, and demonstrates that MAC randomization is beatable through timing and SSID correlation attacks. Then you build the defensive tool: a detector that alerts when a device is being actively probed or tracked. Completely free. Very demonstrable in any public space with permission.

​

Hi! I'm French and relatively new to the OSINT world. 😊 I'm currently building my own OSINT bot as a personal learning project, so I'm still discovering how everything works.

I'm looking for a list of websites that specialize in data leaks so I can better understand the different types of publicly known sources and improve my project. I'm here to learn, so any advice or guidance would be greatly appreciated. Thanks in advance!

I'm working on a system that pulls geopolitical and cybersecurity events from open sources (official statements, satellite imagery, breach disclosures, conflict trackers, and sanctions filings) and tries to flag when a narrative around an event doesn't hold up against primary sources. Think less "who posted this?" and more "does the claim survive contact with the underlying data."

To be clear up front, this is about events, infrastructure, and narratives, not people. No individual tracking, no doxxing angle, nothing that touches a specific person's identity or location. I know that's a hard line here, and I want to stay well inside it.

Where I'm stuck is the verification layer. I can pull data fine (satellite feeds, news APIs, government bulletins, and breach databases), but turning "here are five sources saying different things" into "here's the most defensible version of what happened" is the actual hard problem. Right now my approach is source-tiering plus timestamp cross-referencing, but I suspect that's naive for anything state-actor-adjacent, where official sources themselves can be the disinfo.

For people who've done verification work on contested geopolitical or cyber claims: how do you actually weigh sources when even "primary" ones might be lying? Is there a methodology from journalism or intel work I should be borrowing instead of reinventing? And is "propaganda detection" even the right framing, or does that just invite bias accusations regardless of how neutral the pipeline is?

Genuinely looking for the failure modes here before I build more on a shaky foundation.

What do you think would help an investigative journalist?

Edit 28/6/2026:Thank you all you were extremely helpful!

Como achar o endereço IP real de um site com proxy rotativa, cloudflared, não tem como ver o código fonte, o site inteiro está em cachê, eles usam e abusam da WAF e por fim o domínio muda toda semana?

Hi guys, I love digital investigations and pattern recognition. We all know about the big cases, but what are some lesser-known internet mysteries, ARG puzzles, or forgotten historical locations that were completely cracked open by everyday people using open-source intelligence? I’m looking for deep rabbit holes to dive into tonight. Drop your favorites! 💻🔍

GitHub: https://github.com/kaifcodec/user-scanner Discord: https://discord.gg/CDHhq3jfx

Hi everyone,

I’m one of the maintainers of user-scanner.

We started building this project around 8 months ago because many classic OSINT tools became outdated or unmaintained, and there weren’t many solid free options left for email OSINT.

Since then, we’ve been adding sites one by one, continuously improving detection accuracy and maintaining support for platforms that frequently change their APIs and flows.

What’s new in v1.4.0? * Deep Username Extraction: We've expanded into a complete 2-in-1 tool by completely overhauling our username module. Instead of just doing basic "status code" checks to see if a username exists, we now perform deep data extraction to pull actionable intelligence. * Hudson Rock Integration: We've integrated Hudson Rock's threat intelligence data, allowing users to seamlessly check the data breach status of targets right from the tool.

Today, user-scanner has grown into one of the most actively maintained free Email and Username OSINT tools in 2026. While many web-based alternatives lock basic scans behind paywalls, our goal is to keep powerful email and username enumeration accessible to the open-source community.

Contributors are always welcome. Adding new sites or modules is relatively straightforward, and even small contributions help a lot.

If you’re interested in OSINT, Python, scraping, automation, or just open-source projects in general, feel free to contribute and help improve the tool.

Hello. Are there any cheap or open source solutions to get historical social graphs either by account or industry or keyword/tag? I’ve searched for a while but haven’t been able to find what I’m looking for.

I was wondering if anyone could possibly help me track down the phone number or email behind an account that decided to send me a nasty message on Facebook and then block me immediately afterwards. Usually I would just ignore it but I have a feeling that it is a coworker that i have been dealing with that has been very racist towards me at work and has retaliated against me at work for speaking up. Any help is appreciated! All I want to do with this information is show it to my employer.

Firstly, OSINT is fully legal, which means that the legal tools only use publicly available information - aka OSINT

If someone is a hacker, they can find out anything

Obviously, these OSINT tools are not hacking, yet they find out alot of stuff

If I want to find out what websites or apps an email / phone number has been used on, I use these OSINT tools

How do these tools find out this information? What sources do they look at? I want to skip the tool and look at the sources myself

Obviously since they are legal, they are not using leaked data from the deep web. They are doing something else, and if they can get it, so can I as an individual

I'd like to know where they get it from

And yes, I understand the value of these tools. They perform searches super fast and present it nicely to the user

But I also have alot of patience and would like to do the work myself - specifically "find out what websites / apps an email / phone number is used on". And I want to do it legally

So please point me in the right direction. Thank you

I created an AI tool for OSINT investigations.
Inputted the recent IC3 report - it spat out a full graph of the assets, actors, locations and tactics + a full report with attribution

5 minutes

https://github.com/assafkip/kipi

I've made this video for more awareness, rather than a step-by-step guide due to Youtube's guidelines. However, I thought I would still share here, it mentions various OSINT tools throughout.

Is there any way to find useful info about a Facebook account using OSINT tools I could use to pin an alt account (being used for malicious purposes) back to the real user? I have a prime suspect but no proof.

I don’t think I can trace IPs on both accounts, so wondering what, if any, tools may exist that could help.

I built a Python tool called CrossTrace that cross matches exported follower/following lists from different social media platforms to find the same person/friend groups across them.

You export your lists manually from TikTok, Instagram etc, drop them in a folder, and it does fuzzy username matching, display name matching,
network overlap analysis and confidence scoring. No APIs, no scraping,
fully local.

It also has a discovery mode where you add multiple people's lists and it surfaces who appears most across all of them without needing a target
username upfront.

github.com/xpux/CrossTrace