Skills

Techniques

Email & username enumeration / correlation across platforms
Breach data analysis & credential exposure lookups — maintain a personal collection of 3700+ leaks
Social media investigation — profile linking, activity analysis, network mapping
Metadata extraction (EXIF, document metadata, file properties)
Geolocation — image/video geolocation, landmark identification
Satellite & aerial imagery analysis
Physical/facility recon — satellite and street-view cross-referencing, badge/uniform identification
Domain & infrastructure recon — WHOIS, DNS, subdomain enumeration, certificate transparency, passive DNS
IP/network intelligence — ASN lookup, hosting provider identification
Phone number intelligence — carrier lookup, associated accounts
Image analysis — reverse image search, manipulation detection
Corporate/company investigation — ownership structures, registries, financial filings (FININT)
People search / identity resolution — aliases, public records
Dark web / forum monitoring
Social engineering / pretexting for information gathering
Archive & historical data research — cached content, deleted content recovery
Code repository OSINT — GitHub/GitLab recon, exposed secrets, contributor fingerprinting
Cryptocurrency wallet tracing / blockchain analysis
Vehicle/asset tracing — plates, VIN lookups
Timeline reconstruction / event correlation
Threat actor profiling / attribution

Mostly a mix of custom-built tooling and established OSINT software.

Own tools: Chelicera, Stinger, Mailrain, and others not published publicly.

Third-party: