osint_verified✓

playbooks

Repeatable investigation workflows. Each step says which tools to run and which new selectors it can surface, so you always know the next pivot.

@ starting from username

Telegram channel / group investigationProfile a Telegram channel or group, covering growth, cross-promotion networks and member overlap, and archive its content.3 steps · intermediate · yields username, url, keyword Username → full online footprintEnumerate every platform a handle exists on, separate real matches from false positives, and harvest the pivots each profile leaks.6 steps · beginner · yields url, real name, image, location, keyword, email, ip / asn

✉ starting from email

Email address → identityTurn a single email address into registered accounts, usernames, a real name and a face, without ever contacting the owner.5 steps · beginner · yields domain, company, username, url, real name, image, phone, location, ip / asn

☎ starting from phone

Phone number → ownerIdentify the carrier, line type and likely owner of a phone number, then link it to accounts and addresses.5 steps · intermediate · yields location, real name, url, company, username, email, image

☺ starting from real name

Real name → the right personDisambiguate a common name, then build a profile from public records, corporate filings and social media.5 steps · intermediate · yields url, location, company, phone, email, real name, username, image

▣ starting from image

Photo → where (and when) it was takenThe classic geolocation workflow. Read the metadata, reverse search, extract clues, narrow the search area, confirm with imagery, then estimate the time from shadows.6 steps · intermediate · yields location, file / doc, url

▶ starting from video

Video → verify origin and authenticityArchive a video, find its earliest upload, check whether it's recycled from an older event, and set up geolocation.4 steps · intermediate · yields file / doc, url, image, username, location

◎ starting from domain

Domain → owner, infrastructure, related sitesMap who runs a website and what else they run, passively first, using registration records, DNS history, certificates, shared trackers and archives.6 steps · intermediate · yields email, real name, company, domain, ip / asn, url, file / doc

⌖ starting from ip / asn

IP address → owner, services, reputationWork out who an IP belongs to, what runs on it, what domains point to it, and whether it's known to be malicious.4 steps · beginner · yields company, location, domain, file / doc

₿ starting from crypto

Crypto wallet → attributionTrace a wallet's funds, identify which exchanges or services it touches, and look for anyone who has posted the address publicly.4 steps · advanced · yields crypto, company, url, keyword, username, domain

▤ starting from company

Company due diligenceEstablish who owns and runs a company, where its money goes, whether it's sanctioned or sued, and how it connects to other entities.6 steps · intermediate · yields real name, location, company, domain, email

✈ starting from aircraft

Aircraft → owner and movementsIdentify who owns an aircraft from its tail number and reconstruct where it has flown, including flights hidden from commercial trackers.3 steps · beginner · yields company, real name, location

⚓ starting from vessel

Ship → owner, route and dark activityIdentify a vessel and its owner chain, track its AIS history, and spot gaps that suggest transponder switch-offs or ship-to-ship transfers.4 steps · intermediate · yields company, location, real name