OSINT as a method, not a lucky search

OSINT challenges have a reputation for being unfair, and the reason is that people approach them as a search problem. They are not. They are a *pivot* problem: you are given one identifier and asked to reach another, and the work is in the chain rather than in any single query.

The pivot loop

Every OSINT investigation is the same four steps, repeated until the target is reached or the chain runs out. When the pivot lands you in a pile of files rather than a profile, working a leaked dataset takes over.

1. Enumerate what you have. A username, a domain, an image, an email, a phone number, a wallet address. Write them down; the list is your state.
2. Expand each one. A username has other accounts. A domain has DNS records, certificates, and a history. An image has metadata and content.
3. Cross-reference. Anything that appears in two places is a link, and links are what turn a list into a graph.
4. Record the provenance of every fact, including what you failed to confirm. An investigation whose steps you cannot retrace is not a result.

Usernames pivot better than anything else

People reuse handles far more than they reuse anything else, and a handle is short enough to be distinctive. A username found in one place is worth checking across dozens of others, and the hits are rarely all the same person - which is itself information, because the *writing* usually settles it.

The second-order pivot is the more valuable one: an account's *followers*, its earliest posts, and the accounts it interacts with. A carefully sanitised profile very often has an unsanitised follower who tagged them in 2016.

What metadata actually survives

EXIF is the first thing anyone checks and it is stripped by nearly every large platform on upload. That is worth knowing precisely, because it changes where you look: an image straight from a phone, from a personal site, or from a file-sharing link often keeps everything; the same image from a social platform usually keeps nothing.

Documents deserve the emphasis. A PDF carries its producing software and both timestamps; an Office file carries the author and a revision count, and sometimes the full editing history. People strip photographs and forget files.

Geolocating an image you do not recognise

With no GPS tag, geolocation is deduction from what is visible, and it is far more tractable than it looks because the constraints stack multiplicatively. You do not need to recognise the place; you need to narrow it.

• Which side of the road? Two thirds of the world drives on the right. One binary question, one third of the planet gone.
• Vegetation and light. Sun angle bounds latitude and season together; plant species bound climate.
• Infrastructure. Bollards, road markings, utility pole design, kerb style and licence-plate shape are all regionally standardised and photographed constantly.
• Writing. Not just the language - the *script*, the font conventions, and the phone-number format on a shop sign.
• Anything with a name on it. A business name, a bus route number, a street sign. One searchable string collapses the whole problem.

Then verify, rather than concluding. Historical satellite and street-level imagery is what turns "this is plausibly the place" into a match, and it is also what catches the near-miss - the identical franchise storefront two towns over.

Domains and certificates

For an infrastructure target, certificate transparency logs are the highest-yield source and the least used. Every publicly-trusted certificate issued for a domain is logged, permanently and searchably - so the subdomains an organisation forgot about are enumerable without touching their servers at all.

Passive DNS and archived snapshots do the same for time: what a host used to resolve to, and what a page used to say. A challenge whose answer was deleted from a live site is usually asking whether you know that deletion is not removal.

The line

The other half of that line is about people. OSINT challenges are frequently built around real accounts and real photographs, and the technique transfers directly to real individuals who did not consent to being investigated. Practise on the target the challenge gives you, and leave it there.

The loop, condensed

1. List every identifier you hold.
2. Expand each one in its own native direction - handles across platforms, domains into DNS and certificates, images into metadata and content.
3. Look for anything appearing twice. That is the link.
4. Verify before concluding, especially anything that looks like a coincidence.
5. Keep the trail, including the dead ends.