Spokes.wiki Search About

Synthesis — OSINT

The evolving thesis. Spun out of the hub _inbox security/OSINT cluster on 2026-06-30 from three sources: two AI-OSINT tools (llm-osint, the single-LLM proof-of-concept parked first; kallisto-osinter, the multi-agent orchestrator) and one social-engineering resource list (awesome-social-engineering).

Current thesis

OSINT is reconnaissance, and LLMs are automating the analyst out of the loop. The field has a manual toolkit — Maltego, theHarvester, Shodan, recon-ng — each automating one slice of finding and correlating public data, but gated by an analyst's time: a human runs the tools, reads the output, and decides what to chase. The founding AI tools dissolve that bottleneck along a clear autonomy axis:

  1. Single-LLM loop — llm-osint gives one model a target; it searches, reads, and assembles a profile itself. The minimal proof the pattern works.
  2. Multi-agent orchestration — kallisto-osinter splits the job across a search agent, a knowledge-orchestration agent, and specialized deep-dive agents, with LLM map-reduce over large pages. The same monolithic-→-orchestrated move agent frameworks make generally, pointed at recon.

So the trajectory is manual recon stack → LLM-automated gathering → multi-agent deep investigation (ai-osint). The manual toolkit doesn't disappear; it becomes the substrate the agents drive.

OSINT and social-engineering are one chain. OSINT is the reconnaissance phase; social engineering is the act it enables — a pretext is only as credible as the recon behind it. So automating OSINT doesn't just speed up investigation, it lowers the cost of the reconnaissance behind human-element attacks. The two halves of the founding corpus (AI-OSINT tools + the social-engineering resource base) meet exactly here.

A defensive counter-current — OSINT as a feed, not a verdict. The "automate the analyst away" reading is only one direction. kafsiem (Scalytics) runs the opposite play: it treats OSINT as an input fused with operational/OT data into an auditable entity graph with provenance on every edge, which a human analyst then reasons over. So the field has two poles — autonomous gathering (llm-osint/ kallisto-osinter, analyst-out-of-loop, black-box profile) and analyst-driven fusion (kafsiem, analyst-in-loop, every edge traceable). The provenance/audit discipline is a direct rebuttal to the black-box-profiler hazard, and it pulls the spoke past pure offensive recon toward defensive threat-intelligence.

A second axis: what the recon is of. The autonomy axis (above) sorts tools by how much of the analyst's loop they absorb. swaggerspy exposes a different axis — the target of the recon. The founding tools all profile people (llm-osint, kallisto-osinter) or catalog human-element technique (awesome-social-engineering); SwaggerSpy instead harvests machine secrets — leaked credentials in published SwaggerHub API docs — a Shodan-class attack-surface sweep, not a person lookup. It's also a reminder the AI wave hasn't replaced the classic mode: SwaggerSpy is plain regex over one platform, no LLM. So the spoke now spans two independent axes — autonomy (manual → single-LLM → multi-agent) and object (person-profiling ↔ secrets/attack-surface) — and the corpus is starting to fill the offensive-security-recon breadth the scope boundary anticipated, not just the AI-OSINT corner.

gitsint fills the missing cell of that grid. SwaggerSpy proved the non-AI, single-platform mode on the secrets side; GitSint is the same mode on the person-profiling side — one platform (GitHub), worked exhaustively through its API and public repos, no LLM. So "classic, one-platform enumeration" is a mode that spans both objects, not a quirk of secrets-hunting. GitSint also adds a correlation primitive the people-profilers assumed but never mechanized on a specific platform: the email ↔ identity pivot. GitHub is unusually exposed to it because Git embeds an author email in every commit, so GitSint harvests commit history to map an account to a real email and (in reverse) an email to an account. Depth on one data-rich platform substitutes for the AI tools' breadth across the open web — a third way to cut the space, alongside autonomy and object.

cariddi takes the secrets side back out of single-platform mode. Where swaggerspy scans one corpus (SwaggerHub docs) for leaked credentials, Cariddi crawls any domain list you give it — its own crawler, no external platform to be scoped to — and layers endpoint/subdomain/parameter discovery on top of the same secrets regex-scan. Same non-AI, single-binary mode as SwaggerSpy and GitSint, but the secrets branch is now attack-surface-general rather than tied to one API-doc host.

The corpus finally has a standard and a measurement, and they agree. Until 2026-08-07 every source here was a capability describing itself: a repo, a vendor page, a curated list. Two T1 sources landed together and both push against the autonomy pole from outside the tooling. The Berkeley Protocol (OHCHR + UC Berkeley Human Rights Center) is the field's written professional standard, and its three axes are professional, legal, ethical — not accuracy, not coverage. The CSIR ECCWS study is the field's first measurement in this corpus: eight LLMs scored against a fabricated organization with known ground truth, on accuracy, attribution, traceability and hallucination.

They arrive at the same place from opposite directions. The Protocol says the analyst is a duty; the study says the analyst is a control — because models prompted adversarially perform forced narrative construction, building the story the investigator leaned toward. So "keep the human in the loop" stops being kafsiem's design taste and becomes a requirement with an institutional owner on one side and a measured failure mode on the other. That is the strongest claim this spoke can now make, and it cuts directly against the trajectory the rest of the thesis describes.

One asymmetry to keep visible: the study scores models given evidence, not the autonomous gatherers. llm-osint and kallisto-osinter collect as well as analyse, and nothing here measures collection. The analysis half has a number; the collection half is still self-asserted.

Partly resolved 2026-08-22 — the collection half finally has a number, from next door. vibesearchbench scores the graph an agent brings back against an expert-built ground-truth graph, triple by triple: best frontier model F1 30.30, and the recall/precision split (Claude P 24.88 / R 36.34) says these agents sweep broadly and bring back roughly three irrelevant items for each one that matters. The one model that stays conservative instead misses ~84% of the professional ground-truth set. So the collection stage is not merely unmeasured here, it is now measured somewhere and the number is low.

Two caveats keep it a prior rather than a finding about OSINT. The domain is consumer search, where nothing is hidden on purpose, and the session is collaborative — a simulated user discloses needs as the agent asks. Adversarial collection against a subject who resists is harder on both counts, so 30.30 is closer to a ceiling than a floor for what llm-osint and kallisto-osinter would score. That reading strengthens rather than weakens the analyst-in-the-loop conclusion the berkeley-protocol and llm-osint-reliability-study arrive at from the analysis side.

The defining tension: dual-use

Everything here is dual-use. Aggregating public data feels benign, but assembling fragments into a profile is where privacy harm and surveillance risk concentrate — and automation makes it cheap, fast, and scalable. "Person lookups with psychological profiling" (kallisto-osinter) is a capability for an authorized investigator and a weapon for a stalker or a mass-surveillance operator with the same code. This spoke documents the field for defense, education, and research — the tools and their implications — not to target real people; it foregrounds consent, privacy, ethics, and defense rather than operational playbooks.

The dual-use case sharpens: from gathering to acting (strix)

The section above frames the hazard as automated profiling. strix moves it a step down the chain: ~44.8k★, Apache 2.0, one-line install, runs on a consumer ChatGPT subscription or a local model, and its agents exploit rather than observe. The dual-use argument this spoke has been making about cheap profiling now applies to cheap exploitation, with a much larger user base and a commercial vendor behind it (usestrix).

Two things keep it from being a simple escalation. The delivery model is defensive by default — CI on your own pull requests, patches offered back — which is myip's inversion again at a different layer: point the capability at yourself. And the evidence discipline improves going this direction, because an exploit is self-verifying where a profile is not (autonomous-pentesting).

What doesn't improve is the boundary. Authorization is a README warning, with no technical scope enforcement and nothing distinguishing your staging host from someone else's production. The spoke's standing ethics position (catalog and analyze; no operational playbooks against real targets) is unchanged, and the observation to record is narrower and more useful than alarm: the cost floor for automated exploitation is now a subscription, and consent remains a convention.

A second risk: source contamination, not just privacy

The dual-use section frames the hazard as aggregation harm — public fragments assembled into a profile. The encyclopedic overview osint-overview-wikipedia names a distinct one: disinformation vulnerability. Open sources can be deliberately poisoned — extremist groups and state actors plant false information — so OSINT's problem is also input trustworthiness under an information explosion. This bites hardest on the autonomous pole: an LLM that gathers and trusts public data at scale (llm-osint, kallisto-osinter) is precisely the target a planted-information campaign wants, which reframes kafsiem's provenance-on-every-edge discipline as a defense against bad input, not only a black-box-profiler check. So the spoke now carries two risk axes — privacy/consent (output) and source integrity (input).

Open questions

The census, and what it says the corpus has been missing (awesome-osint-list)

Every source here until now was one instrument. Astrosp's list is the first that shows the whole toolkit at once — ~1,730 links, ~90 sections — and three things in its shape contradict or qualify what the spoke had concluded from the instruments.

One: the field is mostly hosted services, not repositories. The modal entry is a website you open (Dehashed, Intelligence X, GreyNoise, people-search, flight/maritime trackers, sanctions and most-wanted search engines, dozens of Google CSEs). Everything in this corpus except termux-commands-site is code you clone and run. That is a selection bias with a mundane cause — GitHub links are what arrive — and it matters because the two classes fail differently: a repo is auditable and offline-capable, a hosted service logs you, can change its results without notice, and can disappear. The corpus has been theorizing from the auditable minority.

Two: the AI section is mostly AI as the target, not the analyst. Of eleven subsections, one is "AI for OSINT & Threat Intelligence"; the bulk is general assistants plus a substantial LLM-security block — vulnerability testing, red teaming, jailbreak and prompt-injection resources, model and dataset security. The spoke calls ai-osint its leading edge and that still looks right as a trajectory, but this is the first evidence about the base rate, and the base rate says automated profiling is not yet how the work is done. Held against llm-osint's and kallisto-osinter's self-asserted capability, it sharpens growth edge 2 rather than answering it: nobody has measured either the accuracy or the adoption.

Three: the practitioners' own boundary is already the whole offensive chain. The file ends with a bug-bounty wing — attack-surface discovery, enumeration, scanning, fuzzing, API testing, exploitation frameworks — filed as part of OSINT, not next to it. swaggerspy, gitsint and strix pushed this spoke that way one source at a time and each time it read as a judgement call. It isn't; it's the field's own filing.

A fourth thing is not a finding but a warning. Whole sections are organized by who you are investigating — People, Resident Database, Public Records, Police / LE / Fed, Informant, Extremist / Far-Right, War / Military Conflict. The far-right shelf holds DDoSecrets, Unicorn Riot's Discord leaks, ProPublica's Parler archive and START's terrorism database next to raw leak dumps and no-fly list mirrors, with no disclaimer of any kind — unlike awesome-social-engineering, which scopes itself to professionals and controlled environments. This is the dual-use tension in its least mediated form: the same shelf equips an investigative journalist and a person building a dossier on someone. Recorded, not resolved.

The counter-census, hours later (awesome-osint-mcp-servers)

soxoj's list arrived the same day and counts something else: ~60 MCP servers, every one of them machine-callable, across ten categories that reach as far as the census did (blockchain intelligence, market & trading, public records and compliance sit beside SOCMINT and network scanning). It grades T3 rather than T4 because each row states open-source status, pricing tier and whether an API key is needed — an inclusion standard, applied per entry.

The two lists are not in conflict; they are counting different stages. 1,730 links describe what practitioners use, and it is mostly websites. 60 describe what has been wrapped so an agent can call it. The gap is the size of the conversion still outstanding, and it says the automation frontier is early in tool terms as well as in the AI-section terms the census already showed.

What it does change is where the automation lives. llm-osint built its own loop and kallisto-osinter wired its own instruments in; both had to contain their tooling. MCP standardizes the tool layer underneath, so an OSINT capability can now be published for whichever agent shows up. The ai-osint page has been describing agents that include their instruments — this inverts that relationship, and it is the first source here that documents the interface rather than an implementation.

The dual-use consequence is specific and worth stating plainly: none of these capabilities is new, but composition gets cheap. Username enumeration, breach lookup, network scanning and public records behind one model that picks the order is a different amount of work to assemble a dossier than the same four tools run by hand. Like the census, this list carries no disclaimer. awesome-social-engineering remains the only catalog in the corpus that scopes its own use.

The mirror: same primitives, subject-side

myip is the first source here that runs the toolkit inward. Three things fall out of it.

The attribution layer is a short, shared list. MaxMind GeoLite2, CAIDA, RIPEstat, and a handful of commercial geolocation APIs are what everyone resolves an IP against, offensive or defensive (ip-reconnaissance). So accuracy in this branch is inherited from vendors rather than measured, and querying several at once is the field's standing hedge against any one being wrong. It also means the capability has no gate: the same free databases serve an investigator, an ad-tech fingerprinter, and a person auditing their own VPN.

Dual-use, minus the ethical charge. The spoke's dual-use tension is usually about who gets profiled. Here the technique is identical and the target is yourself, which strips the harm out while leaving the capability intact. That makes MyIP a useful reference point for the defensive thread: the honest defensive move against cheap recon is knowing what the cheap recon already sees.

A privacy tool carrying telemetry. MyIP marks a Google Analytics ID required and ships a first-party route for relaying Sentry envelopes past ad blockers. Both are disclosed, and a self-hoster can switch them off. It is still a small standing lesson for this corpus: measuring exposure and reducing it are separate jobs, and a tool that does the first isn't automatically aligned with the second.

The mirror has an outward face too (2026-08-05, cloakquest3r). MyIP runs the infrastructure toolkit inward; cloakquest3r runs the same primitives outward against a protected target, recovering the origin IP a CDN is paid to hide. It is the spoke's first tool whose target is a defensive control rather than a subject — and it sharpens the mirror rather than breaking it, because the two describe one move from opposite ends. What CloakQuest3r exploits is not a weakness in Cloudflare but the target's own leaks: a forgotten unproxied subdomain, a DNS record from before the migration, a re-used TLS certificate. So the defensive reading MyIP implied becomes concrete — the honest defence is running this against your own domain first, and origin exposure is a configuration failure the proxy vendor cannot fix for you.

The counter-side arrives, and it is not clean (mysterium-node)

Growth edge 4 asked for the defensive mirror — privacy hardening or counter-reconnaissance — and the first source on it is a decentralized VPN: peer-to-peer exits over WireGuard, run by whoever wants to rent out a connection, settled on-chain. It does not answer ip-reconnaissance's leak surface at all. WebRTC, DNS leaks and fingerprinting are untouched, and myip would still catch every one of them. What it changes is whose address you borrow.

That single change carries the whole ambiguity. Commercial VPN exits sit in datacenter ASNs, which the attribution layer marks and many services block; dVPN exits are residential, which is the hardest category to tell from an ordinary user and the one scraping and fraud operations pay for. So the corpus's first counter-reconnaissance tool is simultaneously a supply of the resource that makes automated abuse work. The dual-use stance this spoke keeps applying to gathering tools now applies to a defensive one, and in the same shape: identical mechanism, different party.

The second half is sharper and is not about dual use. The exit operator inherits the attribution. Other people's traffic leaves from their prefix, so MaxMind's geolocation, CAIDA's org mapping and RIPEstat's announcement history all resolve to them. Privacy for the person routing through is paid for by someone who volunteered to be the answer to the lookup — a redistribution of exposure rather than a reduction of it. Everything this spoke has written about attribution being cheap and public applies unchanged; only the person on the receiving end has moved. And the incentive design that decides who accepts that trade is exactly what the repository does not document.

The leak surface gets its first source, and it is aimed at the subject (2026-08-13)

ip-reconnaissance has named three leaks a VPN doesn't close — WebRTC, DNS, browser fingerprinting — since it was written, and the corpus held a tool that tests for them (myip) and no source on any of them. nothing-private closes that for the third, and browser-fingerprinting now holds the technique.

What the demo establishes is a negative, and it is the useful kind. Private-browsing mode does not defeat re-identification, because the identifier is never stored on the client: sixteen browser properties are hashed into a fingerprint and matched in a server-side database. There is nothing to clear. The distinction the whole corpus needs from this is issued versus derived — a cookie is given to you and can be deleted, a fingerprint is computed from what your browser already announces.

It sharpens the mysterium-node finding rather than repeating it. That page argued a decentralized VPN changes whose address you borrow and leaves the leak surface untouched, which was an inference from what the software does not do. The claim now rests on a source that demonstrates the surface directly.

The dual-use shape appears again, and this time the pointing is reversed. Every other tool here is built for an investigator and read defensively by this wiki. nothing-private is built for the person being tracked and works by tracking them — the demonstration is the attack, run once, against the visitor who asked for it. That is the cleanest instance the spoke has of identical mechanism, opposite party, and it arrives with the countermeasure list attached.

What it does not supply is any number. No entropy estimate, no uniqueness rate, no stability figure. EFF's Panopticlick and amiunique.org sit in its own reference list and would answer all three. The corpus can now say how the technique works and still cannot say how well.

Tier honesty: T3. One developer's demonstration, nine years old, maintained, self-disclosing about its own false negative (a browser that blanks the canvas leaves the demo looking functional while it silently stops discriminating).

The demo cited its own evidence and did not use it (research pass, 2026-08-13)

The gap above lasted a few hours. The curator asked "Panopticlick?", and the answer was that nothing-private's reference list already contained everything the page said was missing. Three T1 sources came in: eckersley-browser-uniqueness (PETS 2010, the study behind Panopticlick), laperdrix-amiunique (IEEE S&P 2016, the replication) and cover-your-tracks (the EFF tool Panopticlick became in 2020).

The technique is now measured, twice, six years apart, on different technology. 83.6% of 470,161 browsers instantaneously unique in 2010, at ≥18.1 bits — one in 286,777. 89.4% of 118,934 fingerprints unique in 2016, with canvas joining fonts and plugins at the top. Both samples are self-selected and both papers declare it, so the agreement is corroboration rather than a population estimate.

Two findings the spoke could not have reached from the demo.

Instability does not protect you. 37.4% of returning browsers changed their fingerprint within a day, and a simple heuristic re-linked the new one to the old with 99.1% accuracy at a 0.86% false-positive rate. This is the same shape as the attribution problem everywhere else in this corpus: the identifier does not need to be stable, it needs to be re-linkable.

Mobile reversed. Eckersley listed "certain smartphones" among the three groups that resisted; by 2016, 81% of mobile fingerprints were unique — reached from the opposite direction, since mobile plugin lists are unique for 1% of devices against 37% on desktop, and the user agent carries the device model instead. A constrained environment identifies as well as a diverse one. Worth remembering for termux-hosted work: the phone is not the quiet option.

What this does to the defensive question. laperdrix-amiunique ranks the fixes, and the ranking is uncomfortable: no Flash is worth 7 points, generic headers plus no plugins is worth 36% of desktop uniqueness, and only disabling JavaScript takes it below a third. The two large levers belong to browser vendors. On top of that sits Eckersley's paradox — a countermeasure adopted by few makes its users more distinctive. The spoke's mysterium-node finding was that counter-reconnaissance moves the address without closing the leak; this is the harder version, where the user-installable defence is the weak one by measurement rather than by inference.

Growth edge 6 closes at its stated bar — three T1 sources on the defensive side. What replaces it is narrower and real: nothing here measures the 2026 web, and plugins, one of the two top attributes in both studies, no longer exist.

A third axis: distribution (termux-commands-site)

The corpus has sorted itself by autonomy (how much of the analyst's loop a tool absorbs) and by object (person ↔ machine secrets). A tutorial site for termux adds an axis neither covers: who can run this, on what.

143 install-and-run guides, two thirds of them reconnaissance and offensive security, 29 in the OSINT category alone — all written for a phone with no root and no computer behind it. The tools are the same public Python repos this spoke reads directly; the site verifies nothing and adds nothing but five lines of pkg install. That is precisely the point. Every source here so far has described a capability getting smarter: llm-osint automating the analyst, kallisto-osinter orchestrating agents, strix running the whole chain. This one describes the same capabilities getting closer to hand while staying exactly as smart as they were, and it has been doing it since 2023 with no AI involved.

Both directions lower the same cost. strix noted a cost floor — local models instead of a metered key — as the striking detail of autonomous pentesting; the floor under that is a mid-range Android phone and a free app. The autonomy axis measures how little skill the operator needs; this measures how little equipment they need, and the two are independent. A tool can be crude, manual and decades old and still represent an expansion in reach if the population able to run it grows by an order of magnitude.

Two qualifications keep this honest. The platform selects for a narrow slice of the field — API-and-HTTP-shaped recon, because no root means no packet capture — so the phone kit is username sweeps, IP and phone lookups and scraping, not the heavy half of offensive security. And the site is T4: good evidence of its own existence, taxonomy and audience, weak evidence about any tool it describes.

The username-reconnaissance page is the technique that catalog is thickest on, and it closes the thread gitsint opened — the handle sweep is the breadth-first sibling of GitSint's depth-first email pivot. Its AI angle is instructive about where models actually enter a mature technique: Aliens_eye advertises an AI confidence score on results, not AI enumeration. The request loop needs no intelligence; deciding whether a hit is the right person does. That is the analyst's judgment step being absorbed while the mechanical part stays mechanical — the thesis in miniature, though advertised rather than demonstrated.

The platform's constraints stop being inference (2026-08-17). The two qualifications above rested on what the platform obviously is; termux-filesystem-layout, the project's own package-build documentation and the distribution axis's first T1, supplies the mechanism. The prefix is /data/data/com.termux/files/usr, every package's hardcoded FHS path is rewritten at build time, and root is not merely absent but documented as a way to break the install — the package managers refuse to run as it. So "no root means no packet capture" holds for a stronger reason than an unset permission: this is a package set recompiled against a different root, on a sandbox held by UID separation, SELinux MCS and mount namespaces.

It also names a friction the axis had missed. The kernel caps a #! line at 128 or 256 characters and the long prefix eats much of that, so a cloned tool with an ordinary shebang fails to execute with an error naming neither cause. The five-line install is five lines if it works; the reason a phone kit settles on API-and-HTTP-shaped tools is partly that heavier projects fall over on details like this one, not only that raw sockets are unavailable. That sharpens the selection effect rather than changing it.

The defensive read of the whole axis. Defences calibrated against a professional adversary — detecting an analyst, an agent, a datacenter — miss this entirely. There is no signature to catch: a username sweep is a few hundred ordinary GETs from a residential mobile IP, and no single site sees anything worth logging. The exposure a person should assume is the exposure to anyone with a phone, which is the same conclusion myip reached from the subject side and is now true of the identity branch as well.

A third object: place and event (ironsight)

The object axis had two values — the person (llm-osint, gitsint) and the machine or attack surface (swaggerspy, ip-reconnaissance). ironsight adds a third that behaves differently from both: a place, while something is happening in it (conflict-monitoring).

The difference is that the subject cannot be enumerated. Everything else in this corpus works by querying an index — a handle against profile URLs, an address against WHOIS and ASN records — and finishes when the queries are exhausted. A war has no index and no finish. What replaces enumeration is continuous aggregation: a dozen partial, contradictory feeds sampled on their own clocks, with correlation left to whoever is watching. IRONSIGHT is that literally — sirens polled every 15 seconds, markets every 10 minutes, all of it drawn on one map, none of it reconciled.

Three consequences follow.

The autonomy axis runs backwards here. This spoke's trajectory has been manual → single-LLM → multi-agent, with the analyst progressively removed. IRONSIGHT has no model in it at all except an unreviewed machine translation, and it draws no conclusion of any kind. It sits behind the manual toolkit: not automating the analyst's judgment, but widening what one pair of eyes can hold at once. The pole kafsiem occupies — analyst-in-the-loop fusion — turns out to have two very different inhabitants, one building an auditable entity graph and one building a wall of panels. Both keep the human; only one leaves a trace of why anything is on screen.

Capability follows other people's sensors. Person-recon exploits infrastructure built to publish people. Conflict monitoring exploits infrastructure built for something else entirely — public warning sirens, air-traffic transponders, wildfire satellites — and so its reach is set by whatever happens to exist in a given place. IRONSIGHT's two theatres are not symmetric for this reason: Ukraine has a community drone-track feed, Israel has a national siren API, and neither has the other's.

Source contamination stops being a hypothetical. osint-overview-wikipedia named deliberate poisoning as OSINT's structural weakness and this corpus has treated it as a risk to guard against. IRONSIGHT's feed list puts TASS, RT and PressTV in the same undifferentiated stream as Reuters, Meduza and the Kyiv Independent, plus scraped Telegram channels, with no reliability marking on anything. An analyst may well want exactly that — knowing what each side is claiming is the job. But the interface makes no distinction available, which converts a known input-integrity problem into a design decision, and one the project does not discuss. It is the clearest instance yet that this spoke's two risk axes are not equally attended to: the privacy axis gets disclaimers, the source- integrity axis gets a feed list.

There is also a standard here that most of the corpus lacks. The berkeley-protocol was written for this exact material, and it centres on verification, preservation and chain of custody. IRONSIGHT keeps nothing — it is a live view with no archive — so the gap between the practice and the tool is measurable for once, and the tool loses.

The standard is not "keep a human in the loop" (quality cycle, 2026-08-10)

The berkeley-protocol page has been asserting a summary of a document nobody here had read. The full text was extracted this cycle, and the coarse reading — the standard requires an analyst in the loop — turns out to be wrong in a useful direction. The Protocol permits automation outright: "either manual or automatic methods can be used." What it imposes instead is three specific tests, and this spoke's tools fail different ones.

Explainability (¶25). Automated processes "must be understood by users and be explainable in court either by users or developers." That is not a preference for humans; it is a disqualification of methods whose output cannot be reconstructed. An LLM profiler whose method is a prompt fails it while a documented scraper passes.

Data minimization (¶31). Collect only what is justified, necessary and proportional — which the Protocol says in terms "favours itemized, manual collection over bulk, automated collection." The collect-everything-then-cluster shape (kallisto-osinter) is the named anti-pattern, and the stated harms are not only privacy: over-collection means investigators stop knowing what they hold.

Preservation (¶32). The duty against under-collection, and the one no tool in this corpus implements. Platforms delete, users edit, links rot; without a timely preservation request or an independent capture, material is gone. ironsight plots feeds and keeps nothing. Everything else here fetches and summarizes. kafsiem's per-edge provenance is the corpus's only feature that answers a Protocol requirement directly.

So the tension this spoke has been recording between the standard and the automation is sharper than "oversight versus throughput" (growth edge 3). The Protocol's axes are professional, legal and ethical; it never scores coverage, recall or speed. A tool that finds more, faster, earns nothing under it. The open question is now narrower and testable: which automated collectors could survive ¶25 in court, and nobody has run that test.

One methodological precision worth keeping corpus-wide: the Protocol insists on "first copy found online" rather than "first copy online," because closed channels may have carried an item before it surfaced publicly. Attribution is often impossible and is explicitly not required for authentication.

The institution publishes its homework

For six weeks this spoke argued about verification standards while holding neither of the two things the argument turns on: what Bellingcat actually does, and how anyone geolocates anything. Both arrived together.

glan-bellingcat-methodology is the practicing organisation's own manual, ninety pages, published rather than described. Its purpose is admissibility — material gathered "in accordance with rules on admissibility of evidence" — and its reasoning starts from a gap in court procedure. Evidence is normally "produced" by a witness who can speak to its provenance and be cross-examined; a video pulled off the internet has no such witness, so the investigator becomes one, and the paperwork is what they would be cross-examined on. That claim was not left as theory: in 2021 a mock hearing in the context of an English court challenged the admissibility of evidence found under the method, and the draft was revised to answer what came up.

Two things it refuses to do are as informative as the manual itself. It does not teach locating or verifying content, assuming that skill; and it does not cover forensic preservation, because Mnemonic does that. Set against the Protocol reading above, the second is the striking one. Preservation (¶32) is the requirement no tool in this corpus implements — and the field's leading practitioner does not implement it either. It hands the job to another organisation with a preservation sheet and a rule that responsibility transfers when the investigation closes. The corpus had been reading that gap as a missing feature. It is a division of labour, and a tool was never going to close it.

What the craft looks like when it is written down

sun-shadow-geolocation fills the hole the manual leaves. The method reaches a location by eliminating places: compute the sun's position for a date and time, read shadow bearing to fix which way the camera faced, and rule out everything that orientation makes impossible — in the worked example, everything inland and everything south of the Tagus — then settle the remainder on lane counts and palm trees. Five to ten minutes, every step re-runnable by a reader.

That is what geolocation-chronolocation is, and it is exactly the shape ¶25 explainability asks for. The reasoning is the product; the coordinates are a by-product.

The measurement lands on the same axis

llm-geolocation-test is Bellingcat scoring 20 models over 25 unpublished photographs against Google Lens — the first time a source here measures an AI at an OSINT task the assessor performs itself, with ground truth in hand. Three OpenAI reasoning models beat the baseline and the rest did not, but the ranking is the least interesting result. Three findings bear on this spoke's thesis:

Put beside the shadow method, the mismatch is structural rather than a matter of accuracy improving over time. A geolocation earns its status from constraints that force the answer and can be checked; a model returns a place without the chain that produced it. "The model said so" is not a defective geolocation, it is a different kind of object — and it is the kind ¶25 and the Incident Assessment both reject. Bellingcat's own verdict is the narrow one: models are for noticing, not for concluding.

The mirror finally gets a method, from a source that is selling something (2026-08-17)

The subject-side thread in this corpus has been a collection of instruments and no procedure. myip tests the network layer, cover-your-tracks and nothing-private test the browser, cloakquest3r run against your own domain tests the origin. Each measures one channel, which is the wrong unit — osint's own ethics section says the harm lives in aggregation, so an audit that samples channels separately cannot see the thing that does the damage. self-dox-exercise supplies the missing unit and self-osint now holds it: one username and one photograph in, a timeboxed chain out — handle → forgotten account → real first name → city → data-broker file → address. No tool in this spoke runs that chain, and the reason is instructive: every hop needs a judgment about which weak result to carry forward, the step ai-osint documents LLMs absorbing on the offensive side and which nothing on the defensive side has automated.

The terminus is a purchase, not a technique. data-broker is the corpus's first page on where the identity branch actually ends. The link between a handle and a legal name is not inferred; it is bought — a platform held both fields, a broker acquired the data, and a lookup costs about a dollar. That reframes username-reconnaissance slightly: the sweep is not the attack, it is the query that tells you which broker file to buy. It also makes edge 5 sharper rather than closed. This source uses four people-search services and documents none of them; what they hold, where they get it, and what they log about the searcher remain unsourced.

One claim here is new: recon might leave a mark. This spoke has held, since username-reconnaissance was written, that reconnaissance is undetectable — a sweep is a few hundred ordinary GETs and no single site sees anything worth logging; ip-reconnaissance runs entirely against third-party datasets and touches the subject not at all. self-dox-exercise proposes the first counterexample: several brokers refreshing your file in one week, when nothing about you changed, as evidence somebody paid to pull it. If that holds it is a detection channel, which the defensive thread has never had. It rests on an undocumented timestamp field and nobody has tested it, so it enters as a hypothesis with an edge attached (12), not as a finding.

The goal moves from zero to expensive. Every defensive source here so far has been implicitly aiming at elimination — strip the metadata, blank the canvas, close the leak. This one concedes that a person who posts will always leak and re-aims at cost: "leak boring, conflicting, useless data … be visible but expensive to track." That is the same economic frame the offensive pages use when they observe that cheap capability is what makes mass profiling work, turned around and pointed at the attacker's budget. It is also the honest version of what mysterium-node was doing badly — raising the price of attribution rather than pretending to remove it.

And the source is a sales funnel, which is the finding about the genre. Five remediation steps, five links to the author's paid guides; the diagnosis is free and every fix is a product. The evidence throughout is unverifiable first-person anecdote — an address off a "10 pixel blurry Amazon label," an apartment identified from a reflection in a coffee cup in four minutes — with no case, date or subject. Set that beside peter-eckersley, who built the capability, measured it on consenting volunteers, and published the algorithm, the entropy figures and the working defences under his own name. Both pages describe real techniques. Only one of them can be checked, and the difference is not competence but audience: research is written to be falsified, security content is written to convert. The corpus should expect much more of the second kind as this genre grows, because the audience aeon-flex names — people who are public by necessity — is real, underserved, and pays. Grading it T3 rather than T4 is deliberate: the method is stated in full and it is the author's own, but the depth of every section is held back behind the funnel by design.

Growth edges

Ranked; each names the kind of source that would close it (see ../QUALITY.md → Growth edges).

  1. First T1 — CLOSED 2026-08-07 by the research pass, twice over: the Berkeley Protocol (OHCHR/UC Berkeley, T1) and the CSIR ECCWS 2026 study (peer-reviewed, T1). The spoke's floor goes from T1 0 to T1 2.
  2. Measurement of the AI-automation claims — the collection half. Partly closed 2026-08-07: the ECCWS study measures eight LLMs on analysing supplied evidence. What no source measures is autonomous gathering — whether llm-osint or kallisto-osinter find the right things in the first place, and what they miss. — needs: a T1/T2 evaluation of an autonomous collector against known ground truth · hunted 2026-08-08 — nothing ≥ bar. Three benchmarks read and all three score the wrong stage: PolyGnosis 2.0 grades reasoning over a fixed alert feed, Wiki Live Challenge grades the written report against Wikipedia Good Articles, ResearchClawBench supplies the literature and hides only the target paper. Agent evaluation has settled on scoring outputs, and an evaluation of collection needs something this field does not build: a target whose full evidence set is known in advance. Not re-hunted before 2026-08-22. Sharpened 2026-08-13, still open: llm-geolocation-test is the closest thing the spoke now holds — a practitioner scoring 20 models against ground truth it owns — and it measures analysis of a supplied image, which is the same stage the ECCWS study measured. Two independent measurements of the analysis half and none of the gathering half. The edge is confirmed rather than advanced. HALF-CLOSED 2026-08-22 (research pass) by vibesearchbench (T1): 200 expert-annotated tasks whose ground truth is a knowledge graph, scored by triple-level precision/recall/F1 against what the agent gathered — the measurement of the collection stage this edge has been asking for, and the first one found in four hunts. Best frontier model F1 30.30, recall well above precision (Claude P 24.88 / R 36.34), and the one conservative model leaves ~84% of the professional ground truth unrecovered. 2a. Gathering, without a user in the loop, against a subject that resists — new 2026-08-22, the residue of edge 2. vibesearchbench measures a collaborative session in consumer domains: a simulated user discloses needs as the agent triggers them, and nothing in travel or gaming is hidden on purpose. OSINT collection is neither. — needs: the same item-level ground-truth scoring applied to an agent running unattended, ideally on a subject with a deliberately sparse or misleading footprint. HALF-CLOSED 2026-10-01 (research pass) by llm-deanonymization-at-scale (Lermen, Paleka et al., USENIX Security '26, T1). An agent with web search and no user in the loop got a redacted profile and re-identified 226 of 338 Hacker News users at 90% precision, with 25 wrong and 86 abstentions, for $1–4 a target. Ground truth is the LinkedIn link each user put in their own bio. Unattended: yes. Sparse footprint: yes, by redaction. Misleading footprint: no, and the authors say self-linkers are the easy case, so recall is likely inflated. The agent and prompts are withheld, so nobody can re-run it. 2b. A subject who resists, and a dossier rather than a name — new 2026-10-01, the residue of 2a. llm-deanonymization-at-scale scores one item per subject (who is this) on subjects who never tried to hide; vibesearchbench scores many items per task with a helpful user. Nothing yet scores many items on an unwilling subject. — needs: item-level ground-truth scoring of an unattended collector against subjects with planted false trails or active counter-OSINT, or a field study of collection error on real investigations.
  3. What oversight costs. New 2026-08-07. Both new T1s conclude "keep the analyst in the loop," and neither says what that does to the throughput the automation was for. — needs: any study or field report pairing an accuracy figure with an analyst-time figure.
  4. The Protocol's actual requirements. CLOSED 2026-08-10. The 102-page text was extracted with pypdf (the earlier "no poppler" note was wrong) and berkeley-protocol now carries the fourteen principles, the chapter structure, and the source/technical/content analysis split. Successor edge: what the Protocol's explainability requirement disqualifies — no source here tests an automated collector against ¶25's "explainable in court" bar.
  5. Hosted services, sourced properly. awesome-osint-list establishes that the field's modal tool is a website, not a repo, and the corpus holds none of them as a subject. — needs: a T2/T3 source on a major hosted platform (a breach-search or people-search service) covering what it holds, where it gets it, and what it logs about the searcher. Sharpened 2026-08-17, not closed: data-broker names four of them (Whitepages, FastPeopleSearch, Spokeo, Radaris) as the terminus of the identity branch and describes their supply chain only as the author's working model. The spoke now knows these services matter more than any repo it holds and still has nothing first-party on one of them.
  6. The defensive/counter-OSINT side is absent — the mirror of ../defensive-security-wiki's stance. CLOSED 2026-08-13 by a research pass at the curator's go-ahead, three T1 sources in one hop: eckersley-browser-uniqueness, laperdrix-amiunique and cover-your-tracks. The spoke now holds a leak channel measured rather than demonstrated, and the defences ranked by how much they actually buy. Successor edge: nobody has measured the 2026 web. Both studies predate the death of NPAPI plugins — one of the two highest-entropy attributes in each — and neither says what took over. — needs: a post-2020 fingerprinting measurement, or the Cover Your Tracks dataset if EFF publishes one. CLOSED 2026-09-05 by assessing-web-fingerprinting-risk (Bacis et al., WWW 2024, T1): the post-2020 measurement, on a scale neither earlier study could reach — 5,383 surfaces from 161 Web APIs, reported by tens of millions of live Chrome browsers, accurate to within 1.5 bits at 90% confidence. Its methodological point matters to how this spoke should read its own older numbers: the earlier studies summed per-attribute entropies, and summing "grossly overestimat[es]" risk because the attributes correlate. 6a. What replaced plugins, by name. New 2026-09-05, residue of edge 6. The measurement that closed the edge reports entropy by site category and publishes no ranked attribute table, so the specific question — which APIs now carry the 15.4 bits plugins used to — is unanswered by the very paper that measured the surface. — needs: a per-attribute entropy ranking on the current web. 6b. Both instruments belong to interested parties. New 2026-09-05, and it is this spoke's own standing theme arriving in its own subject matter. The new measurement is by the Chrome team, and the paper's stated purpose is "evaluating browser enhancements which are intended to mitigate fingerprinting" — the browser vendor holding the ruler for its own defences, with no replication. The alternative, cover-your-tracks, is run by an advocacy organisation and publishes no dataset. — needs: an entropy measurement by someone selling neither a browser nor a defence.

Coverage edges (added 2026-08-08, at the curator's request for a wider backlog). These widen what the spoke covers instead of answering an open question above; one ordinary solid source closes any.

  1. Geolocation and chronolocation. CLOSED 2026-08-13. sun-shadow-geolocation supplies the craft with its reasoning shown (SunCalc, shadow bearing → camera orientation → elimination, a worked Lisbon example in five to ten minutes) and geolocation-chronolocation holds the discipline. Successor: the craft under adversarial conditions — every worked example the field publishes is one it solved. — needs: a documented failed or contested geolocation, or a study of error rates across analysts on the same image.

  2. Preservation and archival. New 2026-08-10; sharpened 2026-08-13 — glan-bellingcat-methodology shows the leading practitioner also does not do this in-house but delegates it to mnemonic, so the corpus's "no tool preserves" finding is about the tool layer, not about the practice. A page on Mnemonic's own method is now the concrete ask. berkeley-protocol's centre of gravity is keeping open-source evidence usable later — chain of custody, hashing, provenance — and the corpus's only conflict-monitoring tool deliberately keeps nothing. — needs: a source on an evidence-archiving practice or platform (a war-crimes documentation project, an archival toolchain), not another live viewer.

  3. The infrastructure search engines. ip-reconnaissance describes the activity; Shodan, Censys and ZoomEye, the tools that do it, are absent. — needs: their own documentation plus one research use with figures.

  4. The practicing institution. CLOSED 2026-08-13 by glan-bellingcat-methodology (T1, 90pp, published in full), alongside entity pages for bellingcat, global-legal-action-network, mnemonic and uwazi. Successor: what the mock hearing actually broke — the manual says a 2021 admissibility exercise caused revisions and does not say which. — needs: the OSR4Rights/Swansea write-up of that hearing, or either of the two 2022 GLAN/Bellingcat reports on open source evidence.

  5. Media verification. Reverse image search, provenance signing (C2PA) and synthetic-media detection are the counter-side of a corpus that assumes evidence is genuine. — needs: the C2PA specification plus a detection study with error rates.

  6. Does the removal side work? New 2026-08-17. data-broker holds the industry and self-osint holds the audit, and neither covers what happens next: broker opt-out processes, the paid removal services, and whether a deletion stays deleted through the next re-aggregation. self-dox-exercise skips removal entirely — it breaks the linkability that would build a new file and never touches the ones that exist. — needs: a study, journalist test or consumer-agency report measuring opt-out persistence over time (the regulation itself is ../ai-governance-wiki's; the practical outcome is ours).

  7. Is reconnaissance detectable after all? New 2026-08-17, and the higher-value half of the pair. The spoke's standing position is that recon leaves no trace on the subject. self-dox-exercise's broker-refresh tell is the first proposed counterexample, resting on an undocumented "last updated" field that could as easily reflect a scheduled re-crawl. — needs: anything testing it — a broker's own documentation of the field, or a controlled pull-and-watch experiment.

  8. A hit rate for origin-IP discovery (added 2026-08-30, converted from the claim register). cloakquest3r records that "nothing here measures a hit rate against real Cloudflare deployments", and the same silence covers every reconnaissance tool this spoke holds: the techniques are well understood and readable in the code, and not one of them comes with a success rate against defended targets. That matters more here than a missing benchmark usually does, because the whole practice is a probability question — an OSINT tool that works on 5% of targets and one that works on 60% support completely different conclusions from a null result. — needs: a measured success rate for origin-IP discovery (or an equivalent recon technique) against a stated population of defended hosts. T1/T2.

Contradictions / tensions

No internal fact conflicts yet (the three founding sources are complementary — two tools + a resource base). The standing tension is external and ethical: capability vs. privacy/consent, addressed in the dual-use section above rather than as a source disagreement.

Cross-spoke adjacency

Index — OSINT Wiki

Catalog of every page, grouped by schema.org @type. Spine: synthesis (thesis), log.md (history), this file (catalog). Spun out of the hub _inbox security/OSINT cluster on 2026-06-30 (3 sources). Dual-use: documented for defense/education/research — see the ethics stance in synthesis and CLAUDE.md.

DefinedTerm (concepts / disciplines)

Report (standards / sources)

ScholarlyArticle (sources)

Article (sources)

SoftwareSourceCode (tools / sources)

SoftwareApplication (platforms)

WebSite (sources)

Collection (sources)

Organization (entities)

Person (entities)

Synthesis

Notes

Related pages

Links to

Linked from