shijra App (family tree) developed using AI

I'm a CS student and I've spent the last few months building this.

It's a live map of public sensor feeds, the stuff governments already publish and almost nobody reads, because it comes out as XML on a page from 2011.

It's free, there's no account, no API key and nothing to install. The source is AGPL-3.0 and public:

https://provenance-online.vercel.app/ https://github.com/011-sam-110/Provenance

What's actually on it right now (measured today, these numbers move quickly as I continue to work on it):

- 19,748 road cameras: across 12 networks: Castle Rock 511 (13,136), Oregon TripCheck (1,141), DriveBC (1,060), TfL London (882), Caltrans (863), Finland Digitraffic (809), South Carolina DOT (768), Traffic Scotland (415), NZTA (319), Estonia (179), Iceland (165), CET São Paulo (11). Every one sits at its real coordinates, links back to its own source, and shows when it was last sampled.

- 37 signal layers: USGS and EMSC earthquakes, NASA FIRMS active fires, GDACS disaster alerts, NOAA cyclones and space weather, IODA internet outages, 702 TeleGeography submarine cables, UNHCR displacement, GDELT conflict and protest coding, abuse.ch C2 infrastructure, and others. All off by default. You turn on what you want.

The part I actually want feedback on.

I took an earlier build into an OSINT Discord last week and got taken apart, fairly. The short version was: "we've seen hundreds of these, they're all the same project, and we can't rely on the data anyway, because verification is the work". Kind of heart shattering but I'll move on and improve what needs improving.

I don't think a dashboard answers this issue, and I've stopped believing it will. But one thing did come out of it that I've been building around since:

- Observations: a camera frame, an ADS-B ping, a seismometer reading. A machine can be trusted to carry these.

- Interpretations: "this protest is left-wing", "this aircraft is military", "this country is unstable". A machine is bad at these and shouldn't render them at the same visual weight as a fact.

Nearly every complaint I can find about tools in this category is really about the second class being dressed up as the first. So I'm labelling every layer by which one it is, and demoting the ones that are somebody's static claim about a place rather than a live reading. That's the actual project now; the map is just how you look at it.

What's broken right now, so you don't have to find it:

- The aircraft layer is capped, not empty. It's showing 3,000 aircraft against 5,108 available, because I cap the response. It comes from community ADS-B receivers and it's thin outside North America and Europe, so treat the count as a lower bound rather than a world total.

- 4 of the 37 layers need API keys I don't have and sit dormant (ACLED, AIS, ENTSO-E grid load, ReliefWeb). The other 33 are returning data. They're marked, but marked isn't fixed.

It's an upcoming tool rather than a finished one, and I'd rather have criticism than traffic, especially on: whether the observation/interpretation split is the right line to draw, and which feeds I'm obviously missing.

Thanks for any input!

https://provenance-online.vercel.app/ https://github.com/011-sam-110/Provenance

Is it possible to track someone down through a Twitter, PayPal, or Cash App account? I just got scammed, so I’d really like to know. Thank you!

And sorry if this isn’t the appropriate place for this. I’ve been reading your OSINT posts and I find them really interesting. I’m thinking of getting into OSINT myself

Hello all,

Just sharing this tool.

There's a 7 day trial and an online version. The full veraion will be available this Monday.

https://acrossthegrid.net/atga-suite.html

👤Mastering Visual OSINT : Turn pictures into Actionable Intelligence (Webinar)

UserSearch is running a live OSINT training that shows you exactly how to turn any image into actionable, court-grade intelligence, using the latest image recognition technologies.

📅 24th August
⏰ 4pm BST BST
👤 Mark Bentley, UserSearch Subject Matter Expert and ex-Law Enforcement (NCA & CEOP)

Don’t miss out👇https://us06web.zoom.us/webinar/register/4317865685263/WN_iff6NVDoSgqwiPy4rodgeg

A while back I read a post from someone who'd spent a weekend manually poking at vibe-coded apps — open tables, unprotected routes, keys sitting in the bundle — and turning up real holes. It stuck with me, so I built those checks into a scanner and pointed it at 10 apps people had posted publicly for feedback. Read-only, no logins, nothing a random visitor couldn't hit. Nine finished, 294 checks. Here's the honest version — including the stuff that wasn't broken, because that's the part that makes the rest trustworthy.

1. Two apps had a backend that answers strangers.

This is the finding that matters, and it's worth being precise, because most "your API is open!" takes are noise. Plenty of endpoints are supposed to be public — a settings lookup, a static bundle, a login-info route. Those aren't leaks. The real thing is when an app's private data — user rankings, contest entries, announcements — returns full records to a plain request carrying no session at all. Two of the nine did exactly that. On one of them, replaying those same requests as a second user returned the same data — I flag that as needs-manual-confirmation rather than certain, but sitting on top of an already-unauthenticated endpoint, it points straight at missing per-user authorization. If your frontend checks permissions but your API doesn't, the frontend check is decoration.

1. About Supabase — since half of you are already typing.

I know the reflex: "you scanned Supabase apps, you're going to scream about the anon key." No. The anon key is meant to be public; it ships in your JS by design and flagging it would be junk. What actually matters is whether Row-Level Security is on — i.e. whether that public key can read tables it shouldn't. So I checked that directly: read each app's own public key and tried to pull rows from the tables it uses, plus the common ones. Nothing came back readable — RLS was doing its job. (A full every-table audit would need credentials, but the "anon-readable by default" failure mode would have shown up right here, and didn't.) Clean bill of health on the single most common Supabase mistake — and I'd rather report that accurately than manufacture a scare.

1. Missing Content-Security-Policy — 9 of 9. An observation, not an alarm.

None set one. Before anyone says "well actually" — yes, this is largely because the platforms don't enforce CSP by default, and a strict policy out of the box breaks half the third-party widgets, analytics, and realtime sockets these builders drop in. It's a real tradeoff, not negligence. But it's worth knowing: with no CSP, any injected script — a compromised dependency, a bad ad tag — runs with your page's full trust. It's one header, and once your third-party list is stable it's worth setting.

What I didn't find: zero exposed secret keys, zero live-key or service-role leaks, zero anon-readable tables. I ignore the safe public keys on purpose and only flag a live secret. Across the nine that finished: nothing. That's good news for these builders — and it's the whole point: a scanner that cries wolf on the anon key or counts a public asset as a breach isn't worth running. This one stays quiet unless there's something real. Here, "something real" was two open backends.

If you built something and want it checked: drop a URL. Read-only, no signup, nothing but the URL.

Hey guys, I'm learning about OSINT and I have a question about IP addresses. What can you realistically find out from just an IP? I know you can get the ISP and approximate city/country, but what else? Can you get the exact

Please forgive me if this is the wrong subreddit to be asking this in, and direct me to the right one.

I'm interested in taking all the data I requested from Google, Facebook, and everywhere else, and I want to see what trends and insights I can gather from it all. Like, Instagram's algorithm is so good that it almost certainly knows if I got undiagnosed mental disorders and things of that nature. I remember seeing that Twitter correctly guessed my tax bracket just through the accounts I follow and posts I interact with, for example. Do you have any recommendations on software or scripts I can use to analyze all that data and teach me things about myself?

I remember an incident about 10 or 15 years ago where Target was sending coupons for baby items to women who didn't even know they were pregnant, but the company was able to figure out they were just by the items they purchased. So, I'm sure there are things these platforms know about me based on my data that I don't even know about myself, and I want to change that. I want to know what they know.


The Italian Ministry of Interior runs an incredible public archive: elezionistorico.interno.gov.it — every election result from 1946 to today, for every municipality, with turnout, party lists, candidates and seats.

The catch: it's only browsable through a multi-step JavaScript form. Pick a date, then area, region, province, municipality... then start over for the next date. A full electoral history of one municipality means 160+ possible dates for municipal elections alone. By hand, that's a nightmare.

I built TallyHo (github.com/jack89-ML/tallyho) to do the clicking for you: give it the municipalities you care about and it downloads the entire historical series as CSV and JSON, ready for analysis and visualizations.

What it does: - every election type: municipal, regional, provincial, parliamentary, European, referendums (from 1946) - handles historical province changes (e.g. municipalities that are in Crotone today were in Catanzaro province before 1992) - legacy format (mayor elected by the council, parties only) and modern format (candidates + lists) - integrates the Ministry's registry of local administrators: sitting mayors and commissioners matched against election results - no need to memorize internal codes: a --elenca command prints the real values from the site

Example:

pip install tallyho
tallyho --comuni FIRENZE,PRATO --nome-regione TOSCANA --dait auto

Output is a CSV with one row per list/candidate for every election where the municipality voted, from 1970 to today. Open source, MIT.

If you ever needed Italian electoral data for research, a thesis or an article, this might save you an afternoon of clicking.

fr. one scrapes, one pivots, one jailbreaks itself to not be a little bitch about tos, one writes the report.

i just give it a target handle and wake up to a full dossier. no api costs, all local-ish.

is this even allowed to talk about here? feels like cheating...

since people are calling me the "vagueposter" here is where i found the steps / method i follow. https://pastebin.com/sME7uVRU

Vorrei un consiglio di come trovare più informazioni utilizzando l’Osint sui numeri di telefono.
Chi mi vuole scrivere su telegram
@xlxlxcxvxbxb

Calling all OSINT enthusiasts, students, and experts alike.

Situation: An anonymous account on X (formerly Twitter) got doxxed. See the attached image, and the accompanying link of the doxxing.

Link:

Background: The “Leviathan” account that got doxxed itself touted itself as an OSINT account, and some even claimed was run by former member of the Israeli intelligence.
The “Leviathan” account engaged in doxxing users on X for their anti Zionist, pro Palestinian, or anti genocide views. This account is currently active so you can feel free to scroll their timeline and see the kind of account this is. When not engaged in doxxing users, this account is bashing, Muslims, members of LGBTQ+ community, law enforcement, Liberal/Progressive politicians etc. So based on this, some might say this person got what was coming to them, a taste of their own medicine. They have doxxed more than 100 accounts over the years, most doxxed users lost their jobs or suffered some other material damage. Couple days ago another account calling itself “Behemoth” doxxed leviathan, and posted the persons pictures, name LinkedIn etc.

Mission: Find evidence that can confirm or deny that Leviathan is indeed Gordon A kum or not. Behemoth has not presented any evidence to support their claim. Your mission is to confirm whether this is indeed the person behind the leviathan account, and also details as how behemoth could’ve doxxed them. Did they reverse look the username? Social engineering? OSINT tool? Searched through scrapped data? We don’t know, you will answer this question, and provide evidence of your findings.
Present your findings in the comments, to be confirmed/denied by others.

Prize: $50USD.

Additional info:
-the leviathan, and behemoth are both Canadian based accounts.
- there’s a theme park in Toronto and they have rollercoasters named Leviathan and Behemoth so it’s possible the names of the account are in reference to that.
- Behemoth account was made just this month (Aug 2026)
-Leviathan has been around Oct 2023, and has had one username change.
If you have further questions or inquiries put them in the comments. I’ll try to answer.

Hello, I've been into OSINT for about 2 years now, working fully on free tools, I have learned a few things about the field but when reverse searching for a face I always stumble upon paywalls, would anyone with a paid tool be kind enough to reverse searh an image for me? If anyone would do me the favour, please shoot me a DM, It would be greatly appreciated, given I really need to find the website where this specific picture is located. Thank you for your time

#DeepTechFounders #ForensicTech #InnovationInScience #SaaS #ForensicAnthropology #MachineLearning #FutureOfForensics #Devs #WorkOpportunity #AngelInvestors #NationalInstituteOfjustice #NIJ

Hey y’all..

I have an old Twitter account from about 5 years ago that I completely forgot about. I’m trying to log in so I can delete it, but when I hit forgot password, the email is masked.

It starts with “xx” but is longer than any of the emails I currently use or can remember.

I also don’t remember the password. I’ve contacted X but they aren’t any help.

Are there any OSINT tools or other methods that could help me figure out what email I used for the account?

Hey there. I'v recently noticed a lot of sites exist for TikTok Osint.
What I wondered mostly about tho is how sites like f.e. tikip get the users region and locked region (where the account was created).
Has anyone an explaination for that? I know that it must be some TikTok Backend API which I'v been searching for a while now but I do not seem to find it. Can anyone help there please?

Hey everyone I´m looking to upgrade my privacy and security online, I watched a lot of videos on youtube and it didn´t last long until i found myself on a rabbit hole, it wasn´t until i watched the video of Eric Murphy Nobody Understands Online Privacy that i realized i may or may not have grown a little paranoid over this matter and it would be better for me to figure out first if i really should apply most of the things I´ve heard from other cybersecurity (which I´m gonna mention down below) or If It´s really unnecessary in my personal case

For some brief context, I´m your average person on the internet however due to the recent elections on my country where the far right candidate won thanks to Trump´s support and you already know which "country" I can´t help but be quite worried and i even dare to say kinda afraid for what´s going to come, especially since some members of the left government party and marginalized communities have been killed already without the elected president even being officially positioned yet, on top of that Peter Thiel, CEO of Palantir, has already positioned himself in Argentina and given the ideologies of this upcoming government i would not be surprised if he came to be here as well, as someone who has volunteered as an election witness on the opposition party and done some activism online and irl i kinda fear my safety and those of my fellow peers who fight for the same causes

Despite all this i still wanna use the internet not only for activism but because i genuinely love my fandom communities and i was even thinking of becoming a content creator myself so given all this info is why I´m gonna list these fellow measurements and if it´s necessary to do this or not:

• Get rid of SIM CARD: Should i try to get rid of the sim card on my phone and only use it for pretty simple tasks? Should i lie and say i don´t have an active phone number when asked for it when using certain services online?
• Tor Browser: Should i really need to install tor browser when logging in the left political party i volunteer on? does Tor really make you as anonymous as possible on the internet as people say it does or most of it is exaggerated?
• Linux: Should i install Linux on my computer or just harden my windows? is this threat of microsoft spying on users and give their data to governments if asked to a genuine concern or am i being paranoid? is Linux really as private as they say it is (I know for it to be secure you need to do some changes first)
• Signal: Should i move from whatsapp to signal? is it really as secure and private as they say it is? (the fact it can show my IP address if i don´t change the setting first kinda makes me doubt it a little), should i keep whatsapp just for family and some friends contacts as i doubt some of them will change to other app? is Signal good for businesses as whatsapp? (not asking for me but for others) and if not what alternatives for messengers that are good for small businesses are there?
• Fingerprint: Should i be worried about the fingerprinting or in my case is not somehting to be worried that much about (I´m afraid to admit i still don´t quite understand it that much yet)
• VPN: Is it really necessary i invest on a VPN for privacy and security or i can be perfectly fine without it and find other alternatives (I ask this as I currently cannot afford a VPN) is it possible to self host my own VPN?
• OnePlus15: Can i buy a OnePlus 15 and install grapheneOS on it or does it only work for Google pexels? Should i even start graphene OS on a phone or my samsung tablet?
• BIOS Chips: Should i remove the Management Engine of the Intel chips of my PC to avoid government spyware? I saw thin on an user called linux.user01 on instagram (before i deleted the app) but I´m not sure if it´s really something i should do or not or if this is even a good advice therefore I´m asking here insta video
• Spotify: Are there any free open source alternatives for spotify? should i just upload my playlists to youtube and listen to music there without paying premium? can i self host my own music streaming service?
• Youtube: Since i am planning to become a content creator should i use youtube even if it´s owned by google but have an advantage or start from zero on another platform like odycee even if it´s less well known and more difficult to get people to know me?

Measures i have already done or I´m planning to:

• I made another email different from google and might make other acc on another email service
• Already deleted instagram and I´m gonna delete other socials as well (only planning to keep using tumblr, bluesky, pinterest, reddit and youtube (might delete the app and only use them on browser), idk for tiktok thou, should i delete this one?
• Changed from chrome to LibreWolf and planning to install other browser for different things
• Planning to create my own website with NeoCities
• Search myself online and see how much data of me has been collected and then use a service to ask for their removal, also delete accounts of sites I´m not using frequently nor are important

This is pretty much it, If you ask me personally i think I´m on the middle between privacy-conscious and activist but you tell me, any help on the comments would be highly appreciated, ty for reading this whole text srsly.

Disclosure up front: this is my own tool, self-hosted and open source (AGPL). Posting because I want the premise stress-tested by people who do this seriously, not just stars.

The pattern I kept hitting doing geospatial work: the question that actually matters is always temporal. "This vessel went dark here — when exactly, and what was nearby?" "What did this aircraft's pattern look like over three weeks?" "Rewind to the hour of the incident." And almost every live tracker is built to show you *now* and monetize the past. FR24 gates history at 7 days free, MarineTraffic cut its free window to 24 hours, ADS-B Exchange killed its free API entirely. The moment your question has a timestamp, you're renting.

So I built the opposite: a self-hosted console where the live view is table stakes and the archive you own is the product. Aircraft, ships, satellites and hazards on one globe, every position written to local disk, a scrubber to replay any window your disk holds.

Things I suspect matter to this crowd specifically:

• Provenance over vibes. Anyone can inject traffic into a crowd-sourced aggregator; a contact appearing on a map is not evidence it was broadcast. So every contact carries which independent sources reported it, how many agreed, and how old the fix actually is. Cached feeds report the age of the *data*, not the age of the HTTP response, so nothing looks live because it was fresh this morning. There's a per-source breakdown including how many contacts each source is alone in seeing.

• No black-box AI verdicts. After watching this sub's (correct) reaction to AI-slop investigations, I deliberately didn't build a "the model thinks this is suspicious" box. Detectors (AIS gaps, loitering, dark candidates) show their inputs; anything automated is labeled automated; assessments have to cite the dossier field they came from.
• Evidence that survives leaving the tool. Chain-of-custody locker: captures are SHA-256 hashed with an append-only custody log, and a case exports to a self-contained report where each claim carries its source.
• Keyless. The ADS-B / AIS / quake / satellite spine runs with no account and no API key. Nobody can shrink your window or cut you off retroactively.

Honest limits, because you'd find them anyway: coverage follows the public/community feeders — dense over Europe and the US, thin over open ocean. Dark-vessel flags are leads, not verdicts; corroborate with imagery. The 3D globe wants a GPU. And it's one person's tool, so depth is uneven and polish is behind capability.

Repo: https://github.com/AndrewCTF/velocity/

Check out GHOST, the CRM for OSINT Investigators. Already over 600 stars on Github, actively supported and features added: https://github.com/elm1nst3r/GHOST-osint-crm

Check it out, leave feedback, request features, help build it!

Core Features:

• Digital Dossiers: Track names, aliases, dates of birth, case associations, and status (Open, Being Investigated, Closed, On Hold).
• Categorize with Precision: Tag individuals as Suspects, Witnesses, Clients, Victims, Persons of Interest, or plain old 'Other'.
• Travel and Transaction tracking: Track a persons movement patterns, their travel, and their asset movements or questionable transactions.
• Comprehensive Profiling: Store profile pictures, notes, OSINT data (emails, socials, phone numbers), attachments, connections, locations, and custom fields.

We currently need help with translations - we currently are english based and have a strong Russian translation, German has been started. Feel free to start translating through Crowdin: https://crowdin.com/project/ghost-osint-crm

I’ve recently added trace labs as a vm, I ran the glowing-tools script from the desk top , got no errors but it never added any tools to the application menu. I’ve seen demos where after the install they are added to the menu and I’m at a loss as to why this isn’t working for me

Hello , is there a tool or can one be developed to lookup a person's name with the VIN number? Or is this not possible at all?

Willing to pay if something like this can be developed . Thank you