How to monitor someone else WhatsApp activity
OSINT is a universal thing. Someone uses tools to investigate military operations, someone - to follow a husband or wife.
Introducing Watools a service to control someone else's whatsapp. It checks the online status, captures the fact of communication between two users (by the time they were online), gives information about the user's habits (for example, sleep duration) and much more. etc.
In general, Watools is a kind of inside-spy. The target entered the messenger - you receive a push notification. Communicating with the "suspect"? You get testimonials.
Of the minuses: to use the service, you have to pay.
BUT! There is a trial - 8 hours. During this time, you will be able to determine whether the game is worth the candle or not.
https://watools.io/wa-watcher
OSINT is a universal thing. Someone uses tools to investigate military operations, someone - to follow a husband or wife.
Introducing Watools a service to control someone else's whatsapp. It checks the online status, captures the fact of communication between two users (by the time they were online), gives information about the user's habits (for example, sleep duration) and much more. etc.
In general, Watools is a kind of inside-spy. The target entered the messenger - you receive a push notification. Communicating with the "suspect"? You get testimonials.
Of the minuses: to use the service, you have to pay.
BUT! There is a trial - 8 hours. During this time, you will be able to determine whether the game is worth the candle or not.
https://watools.io/wa-watcher
Top OSINT Tools for IP Address Investigation
Here are the top sources we use when conducting IP address OSINT research:
maxmind (GeoIP)
sypexgeo (GeoIP)
ipinfo (GeoIP)
domaintools (WHOIS)
virustotal (Virus Check)
dnsdumpster (DNS)
ptrarchive (DNS)
dnslytics (DNS)
viewdns (DNS)
intelx (Leaks)
leakix (Leaks)
cyberhubarchive (Skype Leaks)
webresolver (Skype Leaks)
talosintelligence (IP Quality)
ipqualityscore (IP Quality)
spyse (IoT)
fofa (IoT)
censys (IoT)
zoomeye (IoT)
shodan (IoT)
alienvault (Framework)
spiderfoot (Framework)
robtex (Framework)
threatcrowd (Visualization)
canarytokens (Logger IP)
grabify (Logger IP)
iplogger (Logger IP)
iknowwhatyoudownload (Torrents)
Here are the top sources we use when conducting IP address OSINT research:
maxmind (GeoIP)
sypexgeo (GeoIP)
ipinfo (GeoIP)
domaintools (WHOIS)
virustotal (Virus Check)
dnsdumpster (DNS)
ptrarchive (DNS)
dnslytics (DNS)
viewdns (DNS)
intelx (Leaks)
leakix (Leaks)
cyberhubarchive (Skype Leaks)
webresolver (Skype Leaks)
talosintelligence (IP Quality)
ipqualityscore (IP Quality)
spyse (IoT)
fofa (IoT)
censys (IoT)
zoomeye (IoT)
shodan (IoT)
alienvault (Framework)
spiderfoot (Framework)
robtex (Framework)
threatcrowd (Visualization)
canarytokens (Logger IP)
grabify (Logger IP)
iplogger (Logger IP)
iknowwhatyoudownload (Torrents)
🔥1
How to monitor economic sanctions globally
Sanctions Explorer is a project initiated by a collaboration between Archer, a former Berkeley-based nonprofit using tech to improve human rights and human security, and C4ADS, a nonprofit dedicated to providing data-driven, evidence-based research on global conflict and transnational security issues.
The current iteration of Sanctions Explorer was developed fully by C4ADS Data and Technology team, and is meant to be a comprehensive source of all current and historical sanctions data across all major sanctioning authorities.
https://sanctionsexplorer.org
Sanctions Explorer is a project initiated by a collaboration between Archer, a former Berkeley-based nonprofit using tech to improve human rights and human security, and C4ADS, a nonprofit dedicated to providing data-driven, evidence-based research on global conflict and transnational security issues.
The current iteration of Sanctions Explorer was developed fully by C4ADS Data and Technology team, and is meant to be a comprehensive source of all current and historical sanctions data across all major sanctioning authorities.
https://sanctionsexplorer.org
The $1,000,000 DeepFake Challenge
The outcomes of the recent Kaggle DeepFake Detection Challenge (DFDC) give you a better sense of how algorithms can manipulate videos and what to look for when you suspect a video may be altered.
On the Kaggle Competition website the description of the challenge says, "AWS, Facebook, Microsoft, the Partnership on AI’s Media Integrity Steering Committee, and academics have come together to build the Deepfake Detection Challenge (DFDC). The goal of the challenge is to spur researchers around the world to build innovative new technologies that can help detect deepfakes and manipulated media." The winners of the challenge were awarded $1,000,000.
This challenge contains 100,000 DeepFake videos and 19,154 real videos, which make up just over 470gb of video data. While the data for this project was based on data from Kaggle's Deepfake Detection Challenge (DFDC).
Here is a link to the Github repository for the winning model.
The outcomes of the recent Kaggle DeepFake Detection Challenge (DFDC) give you a better sense of how algorithms can manipulate videos and what to look for when you suspect a video may be altered.
On the Kaggle Competition website the description of the challenge says, "AWS, Facebook, Microsoft, the Partnership on AI’s Media Integrity Steering Committee, and academics have come together to build the Deepfake Detection Challenge (DFDC). The goal of the challenge is to spur researchers around the world to build innovative new technologies that can help detect deepfakes and manipulated media." The winners of the challenge were awarded $1,000,000.
This challenge contains 100,000 DeepFake videos and 19,154 real videos, which make up just over 470gb of video data. While the data for this project was based on data from Kaggle's Deepfake Detection Challenge (DFDC).
Here is a link to the Github repository for the winning model.
How to track military forces movement on land and sea
Tracking Military Aircraft
Tracking information (detailed route and a variety of technical details) about military aircraft flying over a specific territory (Europe, Middle East etc.).
Tracking Military Ships
An interactive map that shows the location and direction of warships in real time.
Tracking Military Aircraft
Tracking information (detailed route and a variety of technical details) about military aircraft flying over a specific territory (Europe, Middle East etc.).
Tracking Military Ships
An interactive map that shows the location and direction of warships in real time.
How to quickly analyze Javascript files
SourceWolf is an interesting tool for analyzing Javascript files. It finds all the variables, endpoints and social media links mentioned in the code in just a few seconds.
https://github.com/ksharinarayanan/SourceWolf
SourceWolf is an interesting tool for analyzing Javascript files. It finds all the variables, endpoints and social media links mentioned in the code in just a few seconds.
https://github.com/ksharinarayanan/SourceWolf
Ukraine Crisis Tracking Tools
Twitter account @Ernest4003, the founder of Sussex Global Analysis, created a Start. me page with links to several sources of information that track the current situation in Ukraine. From news and sanctions, to cams and links to other sources.
If you are following the crisis, this is a good collection to bookmark.
https://start.me/p/lLBdE6/ukraine-crisis-tracker
Twitter account @Ernest4003, the founder of Sussex Global Analysis, created a Start. me page with links to several sources of information that track the current situation in Ukraine. From news and sanctions, to cams and links to other sources.
If you are following the crisis, this is a good collection to bookmark.
https://start.me/p/lLBdE6/ukraine-crisis-tracker
How to use satellite imagery to visualize changes in landscapes
It is absolutely phenomenal knowing that we live in a time where anyone with an internet connection can easily gain access, for free, to satellite imagery gathered from satellites orbiting Earth. Every day millions of images are collected, capturing every nook and cranny of our planet.
With the right tools and skills all of this data, can help geolocate an image or video and, in some cases, even narrow it down to a time period (this referred to as Chronolocation).
https://gralhix.wordpress.com/2022/02/23/how-to-use-satellite-imagery-to-visualise-changes-in-landscapes/
It is absolutely phenomenal knowing that we live in a time where anyone with an internet connection can easily gain access, for free, to satellite imagery gathered from satellites orbiting Earth. Every day millions of images are collected, capturing every nook and cranny of our planet.
With the right tools and skills all of this data, can help geolocate an image or video and, in some cases, even narrow it down to a time period (this referred to as Chronolocation).
https://gralhix.wordpress.com/2022/02/23/how-to-use-satellite-imagery-to-visualise-changes-in-landscapes/
How to geolocate a Twitter video using free OSINT tools
A case study on how OSINT and geo intelligence enables to geolocate a Twitter video using free OSINT tools and how relying on information from the news can set you back.
https://gralhix.wordpress.com/2022/02/26/how-to-geolocate-a-twitter-video-using-free-osint-tools/
A case study on how OSINT and geo intelligence enables to geolocate a Twitter video using free OSINT tools and how relying on information from the news can set you back.
https://gralhix.wordpress.com/2022/02/26/how-to-geolocate-a-twitter-video-using-free-osint-tools/
Extracting information about Google documents
Xeuledoc enables yo to fetch information about any public Google document, including:
- Google Drive
- Google Docs
- Google Spreadsheets
- Google Slides
- Google Drawning
- Google My Maps
- Google Apps Script
https://github.com/Malfrats/xeuledoc
Xeuledoc enables yo to fetch information about any public Google document, including:
- Google Drive
- Google Docs
- Google Spreadsheets
- Google Slides
- Google Drawning
- Google My Maps
- Google Apps Script
https://github.com/Malfrats/xeuledoc
German infosec agency recommended to stop using Kaspersky antivirus solutions
Do you remember how many years there were talks about suspicions against Kaspersky for cooperation with Russian authorities?
Now, the German infosec agency has recommended that their companies stop using Kaspersky antivirus solutions. They fear that amid international friction, the Moscow-based company could compromise the safety of users of their products. They say the Big Russian Brother will force you to hand over data, spy and arrange cyber attacks. .
Kaspersky, as always, denies everything and calls the decision politically motivated.
Do you remember how many years there were talks about suspicions against Kaspersky for cooperation with Russian authorities?
Now, the German infosec agency has recommended that their companies stop using Kaspersky antivirus solutions. They fear that amid international friction, the Moscow-based company could compromise the safety of users of their products. They say the Big Russian Brother will force you to hand over data, spy and arrange cyber attacks. .
Kaspersky, as always, denies everything and calls the decision politically motivated.
👍1
How to extract forensic evidence from Docker containers
The Docker forensics toolkit enables you to perform forensic analysis of Docker containers based on forensic copies of hard drives of a docker host system. In additon, it allows you to mount a host image, search for machine images and container log files, extract file system metadata and more...
https://github.com/docker-forensics-toolkit/toolkit
Here some additional resources you may find useful:
- A script that automates the process of collecting artifacts from docker
https://github.com/dingtoffee/linuxforensictool/blob/main/Docker%20Forensic/dockerforensic
- Usage scenario
https://github.com/docker-forensics-toolkit/toolkit/blob/master/USAGE.md
- Interesting article on this topic
https://blog.compass-security.com/2021/11/docker-forensics/
The Docker forensics toolkit enables you to perform forensic analysis of Docker containers based on forensic copies of hard drives of a docker host system. In additon, it allows you to mount a host image, search for machine images and container log files, extract file system metadata and more...
https://github.com/docker-forensics-toolkit/toolkit
Here some additional resources you may find useful:
- A script that automates the process of collecting artifacts from docker
https://github.com/dingtoffee/linuxforensictool/blob/main/Docker%20Forensic/dockerforensic
- Usage scenario
https://github.com/docker-forensics-toolkit/toolkit/blob/master/USAGE.md
- Interesting article on this topic
https://blog.compass-security.com/2021/11/docker-forensics/
10 Most popular free tools for your OSINT investigations
1️⃣ Maltego is one of the best data visualization and investigation automation systems in the world. Used even by Interpol and Europol.
2️⃣ Crystal Explorer is a younger, but free version of one of the most famous tools for researching Bitcoin cryptocurrency transactions, as well as identifying crypto wallets.
3️⃣ @maigret_osint_bot Telegram bot and service of the same name for searching for a username (nickname) match on various forums, online services, social networks and instant messengers.
4️⃣ @EmailPhoneOSINT_bot Telegram bot for researching a mobile phone number or email address based on numerous information leaks.
5️⃣ @UniversalSearchBot is another good Telegram bot designed to search for open information.
6️⃣ Search4faces is a tool for searching for matching photos on a user's avatar in social networks such as VKontakte, Odnoklassniki, TikTok, Instagram and Clubhouse.
7️⃣ Canary Tokens - a universal logger that allows you to get data about the connection and device of an Internet user.
8️⃣ Yandex.Audience is a promising tool for ADINT analysis, in a free version that allows you to get the user's social graph by its advertising ID.
9️⃣ SpiderFoot is a cool and automated OSINT service that specializes in researching websites, domain names and IP addresses.
🔟 Dork Search is a tool for automating and prompting when generating Google Dorks queries.
1️⃣ Maltego is one of the best data visualization and investigation automation systems in the world. Used even by Interpol and Europol.
2️⃣ Crystal Explorer is a younger, but free version of one of the most famous tools for researching Bitcoin cryptocurrency transactions, as well as identifying crypto wallets.
3️⃣ @maigret_osint_bot Telegram bot and service of the same name for searching for a username (nickname) match on various forums, online services, social networks and instant messengers.
4️⃣ @EmailPhoneOSINT_bot Telegram bot for researching a mobile phone number or email address based on numerous information leaks.
5️⃣ @UniversalSearchBot is another good Telegram bot designed to search for open information.
6️⃣ Search4faces is a tool for searching for matching photos on a user's avatar in social networks such as VKontakte, Odnoklassniki, TikTok, Instagram and Clubhouse.
7️⃣ Canary Tokens - a universal logger that allows you to get data about the connection and device of an Internet user.
8️⃣ Yandex.Audience is a promising tool for ADINT analysis, in a free version that allows you to get the user's social graph by its advertising ID.
9️⃣ SpiderFoot is a cool and automated OSINT service that specializes in researching websites, domain names and IP addresses.
🔟 Dork Search is a tool for automating and prompting when generating Google Dorks queries.
How to get information on a Russian Federation citizen.
Here are some of the top resources to help you identity verification or get additional useful information about any Russian citizen:
▫️If you are not in the territory of the Russian Federation, then install a VPN in Russia.
1️⃣ Validity of the passport:
http://services.guvm.mvd.rf/info-service.htm?sid=2000
2️⃣ Checking the TIN:
https://service.nalog.ru/inn.do
3️⃣ Credits:
https://app.exbico.ru/
4️⃣ Enforcement proceedings:
http://fssprus.ru/iss/ip
5️⃣ Tax debts:
https://peney.net/
6️⃣ Pledges of property:
https://www.reestr-zalogov.ru/state/index#
7️⃣ Bankruptcy:
https://bankrot.fedresurs.ru/
8️⃣ Participation in legal proceedings:
https://bsr.sudrf.ru/bigs/portal.html
9️⃣ Decisions of justices of the peace of St. Petersburg:
https://mirsud.spb.ru/
🔟 Participation in business:
https://zachestnyibiznes.ru/
Here are some of the top resources to help you identity verification or get additional useful information about any Russian citizen:
▫️If you are not in the territory of the Russian Federation, then install a VPN in Russia.
1️⃣ Validity of the passport:
http://services.guvm.mvd.rf/info-service.htm?sid=2000
2️⃣ Checking the TIN:
https://service.nalog.ru/inn.do
3️⃣ Credits:
https://app.exbico.ru/
4️⃣ Enforcement proceedings:
http://fssprus.ru/iss/ip
5️⃣ Tax debts:
https://peney.net/
6️⃣ Pledges of property:
https://www.reestr-zalogov.ru/state/index#
7️⃣ Bankruptcy:
https://bankrot.fedresurs.ru/
8️⃣ Participation in legal proceedings:
https://bsr.sudrf.ru/bigs/portal.html
9️⃣ Decisions of justices of the peace of St. Petersburg:
https://mirsud.spb.ru/
🔟 Participation in business:
https://zachestnyibiznes.ru/
👍1
Hackers brute-forced TransUnion servers using the password "Password"
Whenever you want to complain about the low information security culture in Eastern Europe, remember this news. Hackers brute-forced the servers of the credit insurance company TransUnion South Africa using the password "Password".
https://www.bleepingcomputer.com/news/security/hackers-claim-to-breach-transunion-south-africa-with-password-password/
The data of more than 50 million customers have been stolen, with a ransom demand of $15,000,000
“Securing customer data is our top priority,” says the company's CEO.
To us it feels like their crystal-clear insecurity obviously has other priorities.
Whenever you want to complain about the low information security culture in Eastern Europe, remember this news. Hackers brute-forced the servers of the credit insurance company TransUnion South Africa using the password "Password".
https://www.bleepingcomputer.com/news/security/hackers-claim-to-breach-transunion-south-africa-with-password-password/
The data of more than 50 million customers have been stolen, with a ransom demand of $15,000,000
“Securing customer data is our top priority,” says the company's CEO.
To us it feels like their crystal-clear insecurity obviously has other priorities.
How to really stay anonymous on Telegram?
Telegram continues to evolve and adapt to world events, which is why it is often called the protest messenger. As it matures, each time acquires additional functions and features, for example:
- Blocking in Russia gave the messenger a built-in proxy.
- Protests in Hong Kong made it possible to hide your number from everyone.
- The protests in Russia made it possible for group admins to become anonymous.
There are still ways to uncover the identity behind a Telegram user, as we previously published here:
https://t.me/espyOSINT/9
And here is a quick guide that will show you what extra measures you can take in order to maintain Telegram anonymity: https://telegra.ph/Naskolko-vy-dejstvitelno-anonimny-v-Telegram-11-21
Telegram continues to evolve and adapt to world events, which is why it is often called the protest messenger. As it matures, each time acquires additional functions and features, for example:
- Blocking in Russia gave the messenger a built-in proxy.
- Protests in Hong Kong made it possible to hide your number from everyone.
- The protests in Russia made it possible for group admins to become anonymous.
There are still ways to uncover the identity behind a Telegram user, as we previously published here:
https://t.me/espyOSINT/9
And here is a quick guide that will show you what extra measures you can take in order to maintain Telegram anonymity: https://telegra.ph/Naskolko-vy-dejstvitelno-anonimny-v-Telegram-11-21
UK soldiers banned from using WhatsApp messenger due to "Russian hackers"
According to Daily Mail, the military has been ordered to stop using WhatsApp for professional purposes, otherwise If so, they may be subject to disciplinary action. The thing is that the command is afraid of the messenger being hacked by Russian hackers, estimating such a probability as high-like: "It is considered highly likely Russia has acquired the same capability"
Regular military units are advised to use Signal instead of WhatsApp. The news will not pass by Boris Johnson, who constantly uses WhatsApp for business correspondence.
https://www.dailymail.co.uk/news/article-10633873/British-soldiers-ordered-WhatsApp-hacking-fears.html
According to Daily Mail, the military has been ordered to stop using WhatsApp for professional purposes, otherwise If so, they may be subject to disciplinary action. The thing is that the command is afraid of the messenger being hacked by Russian hackers, estimating such a probability as high-like: "It is considered highly likely Russia has acquired the same capability"
Regular military units are advised to use Signal instead of WhatsApp. The news will not pass by Boris Johnson, who constantly uses WhatsApp for business correspondence.
https://www.dailymail.co.uk/news/article-10633873/British-soldiers-ordered-WhatsApp-hacking-fears.html
Top OSINT Resources to Identify Email Address Owners
Here is a list of the top sources we use to uncover the identities of email address owners as part of OSINT research or investigation. The topic is quite relevant now so I'm sure this would be helpful for many:
zerobounce (SMTP)
mailboxlayer (SMTP)
epieos (Gmail Check)
GHunt (Gmail Check)
@UniversalSearchBot (Yandex Check)
@yandexidbot (Yandex Phone)
ProtOSINT (Protonmail Check)
intelx (Dorks)
epieos (Skype Check)
infotracer (Service)
pipl (Service)
telpoisk (Service)
@EmailPhoneOSINT_bot (Service)
eyeofgod (Service)
@Tpoisk_Bot (Service)
isphere (Service)
AVinfoBot (Service)
Here is a list of the top sources we use to uncover the identities of email address owners as part of OSINT research or investigation. The topic is quite relevant now so I'm sure this would be helpful for many:
zerobounce (SMTP)
mailboxlayer (SMTP)
epieos (Gmail Check)
GHunt (Gmail Check)
@UniversalSearchBot (Yandex Check)
@yandexidbot (Yandex Phone)
ProtOSINT (Protonmail Check)
intelx (Dorks)
epieos (Skype Check)
infotracer (Service)
pipl (Service)
telpoisk (Service)
@EmailPhoneOSINT_bot (Service)
eyeofgod (Service)
@Tpoisk_Bot (Service)
isphere (Service)
AVinfoBot (Service)
The best tool to identify a vehicle’s brand and model using AI
Some people are great at identifying cars’ brands and models just by looking at the vehicle. I’m afraid I am not one of them. In fact, if I ever had to describe a car involved in some crime I would probably go with something like “it was grey”. Extremely unhelpful I know.
CarNet Uses advanced technology to build an automotive API which is capable of recognizing the Make, Model and Generation of most cars built since 1995, with 97+% accuracy.
https://carnet.ai/
Some people are great at identifying cars’ brands and models just by looking at the vehicle. I’m afraid I am not one of them. In fact, if I ever had to describe a car involved in some crime I would probably go with something like “it was grey”. Extremely unhelpful I know.
CarNet Uses advanced technology to build an automotive API which is capable of recognizing the Make, Model and Generation of most cars built since 1995, with 97+% accuracy.
https://carnet.ai/
Top OSINT Resources to Identify Email Address Locations
Here is a list of the OSINT tools we use to roughly tell where the sender or recipient of an e-mail is located:
emailheaders (Header Check)
traceemail (Header Check)
emailheader (Header Check)
azurewebsites (Header Check)
suip (Header Check)
domaintools (WHOIS)
getnotify (Mail Tracking)
readnotify (Mail Tracking)
didtheyreadit (Mail Tracking)
mailtracking (Mail Tracking)
canarytokens (Logger IP)
grabify (Logger IP)
iplogger (Logger IP)
yandex (ADINT)
google (ADINT)
mytarget (ADINT)
Here is a list of the OSINT tools we use to roughly tell where the sender or recipient of an e-mail is located:
emailheaders (Header Check)
traceemail (Header Check)
emailheader (Header Check)
azurewebsites (Header Check)
suip (Header Check)
domaintools (WHOIS)
getnotify (Mail Tracking)
readnotify (Mail Tracking)
didtheyreadit (Mail Tracking)
mailtracking (Mail Tracking)
canarytokens (Logger IP)
grabify (Logger IP)
iplogger (Logger IP)
yandex (ADINT)
google (ADINT)
mytarget (ADINT)
Geolocating Russian Damage on a Small Ukrainian Zoo
An OSINT volunteer for the Ukraine Witness project by the Centre for Information Resilience, was able to geolocate a zoo that was destroyed by Russian forces. Here’s how he was able to geolocate the exact place where the video was recorded.
https://gralhix.wordpress.com/2022/03/10/geolocating-russian-damage-on-a-small-ukranian-zoo/
An OSINT volunteer for the Ukraine Witness project by the Centre for Information Resilience, was able to geolocate a zoo that was destroyed by Russian forces. Here’s how he was able to geolocate the exact place where the video was recorded.
https://gralhix.wordpress.com/2022/03/10/geolocating-russian-damage-on-a-small-ukranian-zoo/