H
highefforthreads
Iron
- Joined
- Aug 28, 2026
- Posts
- 54
- Reputation
- 51
OSINT GUIDE (PART 1/4)
DISCLAIMER: THIS GUIDE SHOULD BE USED FOR ETHICAL AND LEGAL PURPOSES ONLY. This guide is intended for CTFs, OSINT exercises, public-interest research, and investigations where you have a legitimate reason to investigate. Don't use these techniques to identify, locate, expose, monitor, or harass private individuals. Never attempt to obtain non-public information, or access accounts you aren't authorized to access.
introduction: Alright so I’ve been lurking for a while and been seeing threads about OSINT (open source intelligence), and personally I think it's a really cool and fun thing to do. It’s almost like solving a puzzle or a mystery by using small little clues. I’ve been practicing in tryhackme for about a year now, and i want to share some tactics i learned along the way as a beginner hoping to do this full time one day (as a career) The techniques I am going to describe have some niche things (although I think most people will know them but I want to share this anyways for those who don’t) Also, please use this guide in an ethical way, please do not become a super scary sinister blud who rots on discord all day and contributes nothing to society. Also in this thread I’m kinda unorganized and all over the place so take it if you will. OSINT can actually be a really fun thing to do if you're into solving puzzles and internet mysteries!
01 - Mindset
When you're doing an investigation, it's super important that you do the following things:
Pay attention to every little detail:
You don’t realize how much people reveal about themselves everyday just through small habits. For example, you can tell if someone’s primary language by the way they speak (For instance in Poland, many people don't add a [thing] or the [thing] they just say [thing] because there is no “a” or “the” in the polish language. (obviously this isn't a very good clue because many other languages do the same thing but the point is pay attention to even the smallest of details)
Bridging/pivoting:
Your main goal should be to gather leads so you can “bridge” to other related accounts to uncover more clues. For example, going from Roblox account --> discord account --> link in bio --> social media --> workplace social media showcases how you "bridge" between different platforms based on evidence and leads.
Confirmation:
I cannot stress this enough. I’ve seen so many people find a small clue that is completely false and it leads them to wrong clues. DOUBT every piece of information you get and only accept it once you are confident in it and have SOLID proof. Remember, one bad lead at the beginning of the investigation can mess EVERYTHING up and you will end up finding some random guy in fucking Albania or some shit
The general framework you want to follow is uncover --> correlate --> confirm02 - Roblox account recon:
This section is mainly useful when analyzing a Roblox account in a CTF, OSINT exercise, or other authorized investigation.
Check followers/following:
See if there is anyone with first names, locations (for example some people will have there first name then an abbreviation: “AndreaES” Also, just look through their following to see if any of them are in specific groups, sometimes people will be in friend groups and have the discord server linked which can be useful for later if you find the followers/following and you find a pattern of people in specific groups in a certain language, you can store that in the back of your mind when deciding to narrow countries. Also, those people might be irl connections, and if their names are displayed and you get to the later stages where you find Facebook/instagrams, you often spot people with those names and it's easier to confirm.
Check Groups:
See if there are any smaller groups with less than 100 people ideally, as some people have friend groups where they link discord servers or the friend group might be an irl friend group from a long time ago. After identifying these groups, look through the members and see if you remember any of the followers because now you can establish a mind map of who is the individuals relevant connections (useful for later)
Check Discord Servers:
Ok, now most people use discord and will join big game’s discord server and if your lucky, they might reveal a small clue or sometimes they will link another account through bloxlink which can potentially reveal more. (Keep in mind you can also do this for the individual's favorite game section) if you know this user’s discord, you can go into these servers, go to the search operators at the top right, and type from: user. Do this on server, and you have a chance of finding something. (Remember, every little clue is absolutely necessary.
Study the username:
I’ve noticed a lot of people sleep on the username itself. Like think about it, most people on roblox created their accounts with meaning in their names, and unless your user was like “ejifefeofejf” then it usually has some significance. Common username giveaways include:
1. Birthdate; e.g. “name05” (meaning 2005) or “name2005"
2. first name: e.g. “DonaldVDM”
3. initials: e.g. LTfire
4. Character from game/show: e.g. “Zelda03” (useful for later bc it shows individuals interests which can help with confirmation)
5. country: e.g. “unitedstatespatriot” might be larping country if its like an egangster though so be careful.
Honorable Mentions:
1. Checking Badges to see if the individual joined niche games.
2. Checking whether you can click on the followers/following page. Usually if you cannot, it may signal the user is from the UK but not always. Its good if you have other information pointing to the individual being in the United Kingdom.
3. Check games/game-passes for any small clues.
4. Check past users/join dates for alias hunting/correlating dates.
Tools:
<https://bloxleak.com/>
<https://www.rolimons.com/>
<https://www.rolimons.com/>
Summary:
Roblox is pretty useless in terms of OSINT. It’s good at collecting data and past usernames, but other than that, most people who are privacy conscious will secure their Roblox and private everything. Don’t expect to find any groundbreaking clues, but at least try to find some patterns.
DISCLAIMER ABOUT ROBLOX TECHNIQUES:
Here's the thing, everyone is different, some people may just put random numbers that happen to resemble a country or a birthdate. Use this more as a gauging tool to see if the same user on other platforms has similar clues. This is probably the weakest section tbh, but it's still worth noting.
03 - Discord Recon
Discord recon is useful for narrowing timezones, finding connected links, finding interests and occasional pieces of small but powerful clues. You must be in an active server with an individual where they talk regularly.
look through their connected accounts:
Discord has a feature that lets users connect their accounts. This means you have the physical link + username which can be useful for alias mapping as well as OSINT within each of those connections. guns.lol is another one, as you might find information that can be useful such as other social media, etc.
Track when they seem to talk mostly for timezone recon:
Go to the search operator and browse through their messages and try to correlate when they talk the most/least. However, if they travel frequently, are on college summer break or have a shit sleep schedule this may not work as well. Your best bet is to look at past messages during winter or if you have clues they are in Australia or other countries with different summers, adjust accordingly.
Join servers from Roblox groups:
Well now's your time to go into every server and use the search operators from:user and also use from:user contains:images because lots of times users will screenshot things on discord revealing clues. This usually reveals clues that is useful for later. This usually works in smaller niche servers but may work in larger servers. Another strategy is to join the top 50 most popular game discord servers and use the from:[user] command and see if anything shows up.
Relevant account searching:
What i've noticed is many people will give their IRL socials to online contacts. While it seems harmless if you trust the friend, its actually one of if not the most effective way to find social media accounts. This works best if the individual is aware of privacy and takes active measures (not reusing usernames, wiping data from data brokers, etc) Just apply the same tips in this guide to a few relevant contacts and 95% of the time you will get an instagram/tiktok/other platform account (especially Europe and the United States) where you can look through followers/following and correlate previous data with certain accounts. For example, you could map out a relevant person, use the techniques on them and see if you find any profiles on social media similar to your targets.
DISCLAIMER ABOUT DISCORD TECHNIQUES:
as i said before, everyone is different, some people may just put random numbers that happen to resemble a country or a birthdate. Use this more as a gauging tool to see if the same user on other platforms has similar information.
04 - Instagram:
Lots of people use a tool called “osintgram” which is fine, but I think using your brain is better in this case because if the account is private it doesnt work. Instagram OSINT can help reveal relevant connections, activities, etc.
Public accounts:
Pretty self explanatory. go through the followers/following lists and map out people with common, work places, etc in their bios. Search every little detail. Try to search mainly the "followers" tab because that's where friends usually are. Go through each profile and try to map out a common pattern of what is in each bio. For example, is there a certain school that shows up often? Or maybe a workplace. Thats your next lead.
Private accounts:
Look through the suggested accounts tab. This is usually compiled of the followers/following. Apply the same techniques. Avoid verified people because usually those are just the individuals following not followers. Try to go for people with profiles that have full names and are serious and avoid people with meme profiles/anime/other. Photos of the sky, themselves, or something IRL is usually your best bet. Remember, don't harass these people and respect their privacy. They aren't the target.
Picture hunting:
also self explanatory, look who commented, liked, description of post, and contents of post or any gps location. Search any comments and click on those profiles and apply the same tactics above. Also, use my GEOSINT guide for figuring out where those photos are taken.
Bio hunting:
Look for initials, location, school initials, teams, workplace, businesses, etc.
Tools:
https://github.com/Datalux/Osintgram
https://instalker.org/
https://igexport.com/
FOR TiKTOK AND FACEBOOK:
do the same, there isn’t really much difference between these platforms interns of techniques, I would say instagram is the easiest for recon. The issue with tiktok and facebook is if the individual makes their profile private, there isn't really much you can do. With tiktok/facebook, you need to click everything in the profile. Literally everything. See everyone who liked, commented, etc. Try to find patterns of who commented, who liked, who reposted, ex cetera. Unfortunately there is no scraping tool because of laws and such, so you'll have to do it manually.
05 - Email OSINT:
There isn’t much to say about this section except using tools, so will link the best free tools below.
Finding Partials: partials are basically email addresses tied to an account but they are encrypted usually with *******@gmail.com. However, some websites will show the first/last character and other websites will show the exact length of the address. This can help later to have an email address to search in breaches.
Steps:
1. use a tool like whatsmyname or sherlock to see what sites the individual is on. (best sites are twitter, Steam, Gmail, Discord, Meta)
2. Type their username and click forget password
3. Now you will see an email appear on screen like: ********[email protected] and on another platform maybe m*********[email protected]
4. Now most people have their usernames as their email, so if the character length match up + the first letter is the same as the user, there is high probability of having an email to look in haveibeenpwned (you can apply this same thing with phone numbers)
Google Dorks: Bascially we are using specialized search operators to find emails in google.
1. Go to google menu or any chromium based browser
2. Try searching whatever information you have first. Whether thats a username, email, fulll name, etc. See what shows up.
3. Now, use intext:"Information you have" intitle:"Information you have" inurl:"Information you have" See what shows up.
4. Now, more specific: "Information you have" intext:"Contact" OR "intext:Email"
5. Now even more specific if you know relevant place website they are on: site: insert site.com) intext: Information you have) AND intext:contact
Tools:
1. <https://emailosint.org/>
2. <https://fingerprint.to/>
3. <https://oathnet.org/>
4. <https://haveibeenpwned.com/> (is not great in my opinion)
5. <https://epieos.com/>
6. <https://www.osint.industries/> (supposedly the best one idk I have never used it)
7. <https://www.csint.tools/>
Tip:
you can use a technique known as google dorking to search for the email in google. Sometimes files showcase the email.
SCROLL DOWN FOR MORE!
Last edited:
