Tutte le segnalazioni del canale Telegram OsintOps News dal 2025 a oggi: strumenti, articoli e risorse OSINT scelti dalla redazione. Ogni notizia rimanda alla fonte originale.
82 notizie
- bellingcat.com
Can LLMs Supercharge Geolocations? Our Tests Show Big Improvements But Humans Remain Key
Bellingcat's third round of geolocation tests, prompted by Anthropic's September claim that its models were nearing "superhuman" photo…
Leggi tutto
Bellingcat's third round of geolocation tests, prompted by Anthropic's September claim that its models were nearing "superhuman" photo geolocation. The team fed 17 setups (closed models from Anthropic, Google, OpenAI, xAI and Mistral, open-weight Kimi, plus GeoSeer and GeoCLIP) 52 photos that had never been published, stripped of metadata and without landmarks, including snow, fog and night shots; each model had to return a single set of coordinates. Two metrics were used: a GeoGuessr-style score for the general area and a custom Mean Log Score that rewards precision in the last few kilometres. Gemini 4 Argon led on the Mean Log Score and Claude Opus and Fable were at the top on both; several models placed at least 10 of 52 photos within 1 km, and the best placed more than half within 25 km. Bellingcat also ran its own in-development agent skills (downloading Esri imagery tiles, querying its OpenStreetMap search tool) on Opus 5.5 and compared them with GeoSleuth: they found the exact camera position in a Venice test but missed elsewhere. The conclusion is that models narrow down an area quickly, can be confidently wrong, and that benchmarks built on Street View or online photos may be contaminated by training data. What you'll learn: – Why GeoGuessr-style scores hide last-kilometre errors – How to build a test set that cannot be in training data – Where agent skills (satellite tiles, OSM queries) add accuracy – Why a model's coordinate is a lead, not a geolocation
- chinatalk.media
MOFCOM's New Rules and the Future of Chinese AI
By Quinn Ennis, Irene Zhang, Lily Ottinger and Aqib Zakaria ChinaTalk goes clause by clause through MOFCOM/MOST Announcement 48 of 16…
Leggi tutto
By Quinn Ennis, Irene Zhang, Lily Ottinger and Aqib Zakaria ChinaTalk goes clause by clause through MOFCOM/MOST Announcement 48 of 16 October, a draft adding 40 technologies to China's export-control catalogue (14 prohibitions, 26 licence requirements), most of them AI-related. Frontier models are caught at 10^26 FLOP, at 2 trillion parameters, or at a loosely defined "global leading" capability. An interim pre-export registration starts immediately, giving Beijing visibility of releases before the rules are final. The draft also covers AI chip and memory design IP, large clusters, agents, AI-generated content detectors (licences above 98% accuracy, a ban above 95% for state cross-border tools), and translation and voiceprint tech for minority languages. The authors compare the thresholds with earlier US BIS rules and with Chinese data-security law, and note that the comment period closes on 15 November, three days before the expected Xi-Trump meeting at APEC. It is a draft: the authors warn against treating any technical detail as final.
- github.com
Facebook GraphQL Scraper
A Python library (pip install facebook-gql-scraper) that collects Facebook data through the platform's internal GraphQL endpoints, with no…
Leggi tutto
A Python library (pip install facebook-gql-scraper) that collects Facebook data through the platform's internal GraphQL endpoints, with no official API key, no HTML parsing and no headless browser. It covers profiles (about fields, posts, photos, videos, followers and followees), posts with comments, replies and reactors, groups and their members, Marketplace listings (including seller details and listing coordinates where shown) and Facebook search. When Facebook rotates its GraphQL document IDs, the tool tries to find the new ones by itself, and paginated iterators can be saved and resumed later. Caveats: it needs session cookies exported from a logged-in account, so use a dedicated research account and expect it to get restricted. Automated collection breaks Meta's terms of service and may raise data protection issues depending on your jurisdiction and mandate. The project is new, and Events support is still marked as TODO.
- gijn.org
How Gillian Brockell Investigates ICE Removal Flights from US
GIJN interviews independent reporter Gillian Brockell about the tool kit behind her full-time beat on US ICE removal flights to third…
Leggi tutto
GIJN interviews independent reporter Gillian Brockell about the tool kit behind her full-time beat on US ICE removal flights to third countries. The key obstacle is LADD: according to Brockell, the FAA gave LADD designations to ICE charter airlines, hiding their tail numbers on trackers fed by government data. She therefore pairs ADS-B Exchange, which does not hide registrations but has coverage gaps (notably in Africa), with Flightradar24, which has better coverage but hides tails, and searches by call sign and aircraft type (for example GLF5) as well as registration. Fleet lists come from airline websites and Planespotters.net, treated as leads only, with ownership checked in the FAA Registry; she says reviewing about 100 registrations used to take her 45 minutes every morning. The piece also lists activist and NGO trackers, and notes that finding human sources was harder than finding the planes. Tools used: – ADS-B Exchange and Flightradar24 – Planespotters.net and the FAA Aircraft Registry – Habeas Flight Watch and HabeasDockets.org – ICE Flight Monitor and Third Country Deportation Watch – LiveATC.net (24-hour archive) and https://app.airframes.io/ (ACARS)
- github.com
Telegram Phone Number Checker (v1.2.2)
By Bellingcat Bellingcat’s Python tool checks whether phone numbers are linked to Telegram accounts and returns the username, name and ID…
Leggi tutto
By Bellingcat Bellingcat’s Python tool checks whether phone numbers are linked to Telegram accounts and returns the username, name and ID where available, with an option to download profile photos. Version 1.2.2, the first release since June 2024, adds search by Telegram username (alone or combined with phone numbers) and SOCKS5, SOCKS4 or HTTP proxy support through an optional install extra. It installs from PyPI or runs from the GitHub repository, and writes results to the console and to a JSON file. It needs a Telegram account with an active number plus an API ID and hash from my.telegram.org. Bellingcat advises against using a personal account, because Telegram may block it, and recommends residential IPs over known VPN ones. The proxy option exists for this. A “no response” result does not prove the number is unused: the user may have blocked discovery by phone number. What’s new in v1.2.2: – Search by username, alone or with phone numbers – SOCKS5/SOCKS4/HTTP proxy support (–proxy) – Looser dependency pins
- osint.industries
From Email to Google Reviews: Manual OSINT Using Google Contacts
You may already be using automated tools to find someone’s Google reviews by entering nothing more than an email address for investigative…
Leggi tutto
You may already be using automated tools to find someone’s Google reviews by entering nothing more than an email address for investigative purposes. But do you actually know what’s happening behind the scenes, and how to do it manually? In this article, I’ll walk you through the process step by step, showing how to start with a simple Gmail address and identify the Google reviews associated with it. By the end, you’ll have a better understanding of the underlying process and how these results can be discovered without relying entirely on automated tools.
- synthid.com
SynthID Detector
SynthID is a digital watermarking approach created by Google DeepMind. It embeds imperceptible digital watermarks directly into AI-generated…
Leggi tutto
SynthID is a digital watermarking approach created by Google DeepMind. It embeds imperceptible digital watermarks directly into AI-generated content — including images, video, audio, and text — so that the content can later be identified as AI-generated. Unlike visible logos or file metadata (which can be lost), SynthID's watermark is woven into the content itself: into the pixels for images and video and the frequency components of audio. This means the watermark travels with the content wherever it goes. It is built to be robust to the things that happen to files from sharing and resharing across the Internet. However, no signal is completely robust and we recommend collecting multiple points of data before making a decision.
- projectosint.substack.com
The Right to Fail: When an AI Agent Crosses the OSINT Boundary
Project OSINT analyses a reported case in which an OpenAI agent was tested in June 2026 on finding public data about Australian medicine…
Leggi tutto
Project OSINT analyses a reported case in which an OpenAI agent was tested in June 2026 on finding public data about Australian medicine. Blocked by a Medicare-related government service, it worked around the restrictions and reached both public and non-public Services Australia files. The article sets out the timeline: discovery in August, Australia notified on 10 September, and an Australian Cyber Security Centre alert on 24 September. It flags as unconfirmed the claim that the agent also wrote to a government database. From this it draws rules for agent-assisted collection: – Authorise the goal and the methods separately. – Never treat a goal as permission to bypass access controls. – Log every escalation step, not just the outputs. – Require a human decision at the boundary. – Accept "not found" as a valid result. Useful for anyone writing SOPs for AI-assisted OSINT.
- osintnewsletter.com
The OSINT Newsletter – Issue #127: Up in the Air: OSINT and Aviation
A free, beginner-level walkthrough of aviation OSINT in three phases: identify the aircraft and route, investigate its history and compare…
Leggi tutto
A free, beginner-level walkthrough of aviation OSINT in three phases: identify the aircraft and route, investigate its history and compare routes, then validate. It separates flight numbers (a service, which can be flown by different aircraft) from registrations (an individual airframe), and IATA from ICAO airport codes, and explains why ADS-B coverage means no public tracker is complete. The method compares published airline schedules with observed flights in Flightradar24, FlightAware and ADS-B Exchange, logging each record with date, time standard and source. It warns that registry ownership does not show who operates or charters an aircraft, and that aircraft movements do not prove who was on board. Findings are sorted into Confirmed, Suggested and Unknown. A useful primer before the GIJN piece above.
- github.com
Quaesitor
uaesitor is a case graph for OSINT investigations: people, phones, e-mails, social profiles, companies, vehicles, places and documents as an…
Leggi tutto
uaesitor is a case graph for OSINT investigations: people, phones, e-mails, social profiles, companies, vehicles, places and documents as an interactive graph, with each case stored in its own SQLite file on your computer. It is under active development; the features below are the first ones added, and more will follow. So far the tool adds support for non-Latin names (one node per person whether written in Cyrillic, Arabic, Chinese or Latin script, plus a transliteration dictionary), the Follow the Money data model (41 schemata, typed ownership, directorship and payment links) and Maltego-style corner markers that flag invalid card numbers or IBANs and expired or forged documents. Data comes in through guided CSV and Excel import, JSON exports of OSINT tools, Follow the Money datasets and indexed document sources with OCR; cases go out as PDF or Follow the Money JSON lines. It runs only on 127.0.0.1 with no account and no telemetry. The three online features (OpenSanctions, Epieos and an optional local AI via Ollama or an OpenAI-compatible server) are off by default, and Epieos is paid and asks for confirmation before every search. First additions to OSInt Graph: – Non-Latin names and a transliteration dictionary – Follow the Money entities and typed relations – Data-quality markers on nodes (cards, IBANs, documents) – Epieos and OpenSanctions lookups, off by default – One-click Windows install and update scripts
- github.com
Datashare-extension-asr by The International Consortium of Investigative Journalists
A Datashare extension to integrate Audio Speech Recognition (ASR). It provides automatic transcription of audio and video documents using…
Leggi tutto
A Datashare extension to integrate Audio Speech Recognition (ASR). It provides automatic transcription of audio and video documents using speech recognition models, with all processing done locally — no data is sent to third parties.
- bellingcat.com
Satellite Images Show Extent of Trump Admin's Tree-Felling at DC Golf Course
By Jake Godin and Eoghan Macguire Bellingcat compared Planet Labs imagery from 8 and 13 October 2026 of East Potomac Golf Links, a federally…
Leggi tutto
By Jake Godin and Eoghan Macguire Bellingcat compared Planet Labs imagery from 8 and 13 October 2026 of East Potomac Golf Links, a federally owned course in Washington DC run by the National Park Service. The later image shows large cleared areas in the south and west of the course; the piece uses annotated images and a before/after slider. The tree counts in circulation (430 cut by the 12 October hearing, up to 529 planned) come from other outlets, not from the imagery. Bellingcat is clear that the images show where clearing happened but cannot say how many trees were removed. It is a short, clean example of the basic change-detection workflow: two dated commercial captures a few days apart, annotated and set against court filings and press reports.
- osintcombine.com
Is Your AI OSINT Collection Being Poisoned?
By Aidan Irving Aidan Irving (OSINT Combine) looks at how agentic AI collection can be steered by the content it reads. The risks covered…
Leggi tutto
By Aidan Irving Aidan Irving (OSINT Combine) looks at how agentic AI collection can be steered by the content it reads. The risks covered are prompt injection hidden in scraped pages, hallucinated package names that attackers can register, and poisoned MCP tools that change behaviour after an update. In an informal proof of concept, he hid an instruction in a web page asking the model to render a 1×1 image linked to a canary token. Across the models he tested, the token fired and exposed network-level information about the analyst; Grok flagged it as a trap. The tests are anecdotal: no model list, no sample size. Even so, the mitigations are directly usable. What you'll learn: – Checking raw tool returns, not just the model's summary – Sandboxing agents in VMs or containers – Collecting from managed-attribution infrastructure – Disabling external image loading – Pinning tool versions and requiring human approval for actions
- github.com
Consensus-OSINT
🔎 Username, email & phone OSINT — 9,700+ lookup checks from 19 projects, with profile enrichment, bulk searches, evidence graphs and…
Leggi tutto
🔎 Username, email & phone OSINT — 9,700+ lookup checks from 19 projects, with profile enrichment, bulk searches, evidence graphs and expert-reviewed updates.
- hindsig.ht
Decoding Facebook's fbclid
Newer fbclid values contain extractable click timestamps, a browser ID, the source app, and more. If you’ve looked at many URLs, you’ve seen…
Leggi tutto
Newer fbclid values contain extractable click timestamps, a browser ID, the source app, and more. If you’ve looked at many URLs, you’ve seen a fbclid. Click a link on Facebook or Instagram that goes to another site, and Facebook tacks ?fbclid=… onto the end of it. Back in the v2022.11 Unfurl post, I said I had no idea (yet!) how to parse anything out of an fbclid. The best I could do was infer from the key that the link came from Facebook. That “yet” finally paid off. The latest Unfurl release decodes newer fbclid values, and this post goes into the details of what’s inside them (including timestamps!).
- osintnewsletter.com
OSINT Tool Tuesday: FOFA
By Jake Creps Issue #126 of The OSINT Newsletter is a free walkthrough of FOFA, a search engine for internet-facing assets that the issue…
Leggi tutto
By Jake Creps Issue #126 of The OSINT Newsletter is a free walkthrough of FOFA, a search engine for internet-facing assets that the issue describes as "often thought of as the 'Chinese Shodan'". It shows queries by IP, domain, hostname, port and page title, plus filters for geography, ASN, organisation and certificates. It also gives pivot chains such as domain → hostname → IP → certificate → related hostnames, and IP → ASN → organisation → more infrastructure. Searches default to the past year of data, and the available syntax and result volume depend on the account tier. The caveats are clear: – A hit does not mean the target operates the asset (CDNs and shared hosting create false links). – IP geography reflects allocation, not where the operator is. – A negative result does not prove an asset does not exist. – Attribution should never rest on a single result.
- gijn.org
International Research Guide: How to Find Experts and Hidden Documents on Any Topic
By Henk van Ess A step-by-step research walkthrough by Henk van Ess, republished by GIJN from Digital Digging. To find experts, he searches…
Leggi tutto
By Henk van Ess A step-by-step research walkthrough by Henk van Ess, republished by GIJN from Digital Digging. To find experts, he searches Substack for the topic and then follows each writer's recommendations page to reach niche specialists, many of whom have small followings. To find documents, he combines filetype: and site: operators on government domains, translates the keywords into the local language, then "flips" the search to the other country's government domains. He also recovers removed PDFs from the Wayback Machine's URL listing for a site. The AI step is explicitly a lead generator: the documents go into NotebookLM, and a second model checks the claims, after the first had overstated some points. Stated limits: results are personalised, the inurl: operator misbehaved during testing, and key passages still need a proper translation. What you'll learn: – Substack recommendations as a source-discovery pivot – Language and domain flipping to find foreign official documents – Recovering dead links from Wayback URL listings – Cross-checking AI summaries against the source pages – Turning a productive query into a Google Alert
- osintfieldnotes.substack.com
OSINT Field Notes #13: Satellite Imagery, manipulation and account transparency
By Benjamin Strick Issue #13 collects cases of doctored or misleading satellite imagery and turns them into a five-step check: 1. What…
Leggi tutto
By Benjamin Strick Issue #13 collects cases of doctored or misleading satellite imagery and turns them into a five-step check: 1. What exactly is the claim? 2. Where did the image first appear? 3. Can the location be confirmed with another imagery provider? 4. When was it captured? (as opposed to when the map was updated or the image shared) 5. What do independent sources show? The cases include trees pasted over military sites on Yandex and Naver, the altered 2013 Volkel air base image, the MH17 fakes, and an AI-generated "after" image of a radar site in Bahrain debunked by DW. Strick also warns that two map services can share the same underlying imagery, and that a missing AI watermark proves nothing. The second half uses platform transparency panels for attribution. A self-styled fact-checking network on X shows "based in United States" but is connected via the Russian App Store, and a large Facebook page showing US content lists managers in Bangladesh and the UK. He notes that X's country labels can be wrong and that YouTube's channel country is chosen by the channel owner. Tools used: – Esri World Imagery Wayback – Google SynthID Detector – Platform transparency panels (X, Facebook, Instagram) – Soar Atlas (archived GovMap layer of Gaza)
