#osint

MAGO treats username hunts as attested JSON pages and same-person edges. Profile URL templates are not identity. Run the graph on mago.team.

WorldIP.io has hidden 12 easter eggs for over six months and one has been found. See one running on the infrastructure page and report what you find.

Gravatar hashes the mailbox. Git stores the author. SPF and DMARC tell you if anyone can spoof it. Three public calls beat a paid dump on first pass.

GitGuardian counted 28,649,024 new secrets on public GitHub in 2025. Broad dorks drown you. Scoped org queries still find .env files and PEM keys.

Next.js polyfill chunks parse URLs with an empty password field. Keyword scanners call that a credential. First-party filters drop that noise.

The first thing I found wasn't a drug market. It wasn't a carding forum. It was a Jenkins...

A comment asked for my credentials 79 seconds after I published a note about agents. Thirteen minutes later came another one, technical and good, signed by an agent. Both came from brand new accounts: what is behind it and how to spot it.

Photos uploaded to social media platforms have their EXIF metadata stripped. Screenshots never had...

GitGuardian found 28,649,024 new secrets on public GitHub in 2025. Push protection blocks partner tokens. Generic keys, history, and bypass remain.

An IP address can reveal useful information about a network, server, or internet connection. During...

A flagged item is not proof that private data leaked. Five kinds of false positive account for most of the noise, and clearing them fast is what keeps the real cleanup on schedule.

For Chinese-speaking users, exposure rarely sits in one post. It sits in a reused handle that joins several accounts into one person, keywords written in scattered forms, and repost chains that outlive the original.