OsintSupport

Open Source Intelligence | Web Scraping | Reverse Engineering | [email protected]

[OsintSupport @OsintSupport]

@iamTiresias @BenDoBrown Collect enough data you can identify people based on sensitive locations

Then you pull up all their activities and more often than not you then identify their home address

Home/Work are two of the main places people do activities to and from

Example

https://t.co/Zr5VZBEdPy

[OsintSupport @OsintSupport]

[#OSINT|#SOCMINT|#OPSEC] If you collect enough location/fitness data and create some simple tooling around it, you are able to create a very powerful reverse lookup tool.

Restricted locations are more vulnerable to this technique.

1/5

[OsintSupport @OsintSupport]

@BenDoBrown Strava is the gift that keeps on giving! 😆

[OsintSupport @OsintSupport]

@GBPolitcs A few years ago I scraped all the activity data from Strava, then built custom tooling to search all activities against any location in the world.

Here is the Nuclear Naval Base in Scotland, Faslane. I could then identify many of their home addresses.

https://t.co/gsFFW4q3Kq

[OsintSupport @OsintSupport]

@ViaerFou @ViaerFou Heres a small sample of location data i have for that same place.

[OsintSupport @OsintSupport]

@Richard_AHolmes A few years ago I scraped all the activity data from Strava, then built custom tooling to search all activities against any location in the world.

Here is the Nuclear Naval Base in Scotland, Faslane. I could then identify many of their home addresses.

https://t.co/gsFFW4q3Kq

[OsintSupport @OsintSupport]

@ViaerFou @ViaerFou Heres a small sample of location data i have for that same place.

[OsintSupport @OsintSupport]

@EthicalHoopz @PolitlcsGlobal @lemondefr All you have to do is scrape the activities on a regular basis and you can do this all day long, despite even the pentagon telling it staff to stop using strava they still do, along with lot of other sensitive locations.

Ive posted a few times about it

https://t.co/Zr5VZBEdPy

[OsintSupport @OsintSupport]

[#OSINT|#SOCMINT|#OPSEC] If you collect enough location/fitness data and create some simple tooling around it, you are able to create a very powerful reverse lookup tool.

Restricted locations are more vulnerable to this technique.

1/5

[OsintSupport @OsintSupport]

@LifeInGen6 @TechloreInc What’s more wild is how this method is very very rarely protected with rate limiting. Facebook, WhatsApp, Apple, Strava, all of them have fallen fowl of this.

[OsintSupport @OsintSupport]

@nbacyberguy @CraigHRowland Exactly. However that would take a level of integrity he clearly lacks. Instead of admitting he’s wrong, he doubles down. Even his Tor comment is nonsense.

[OsintSupport @OsintSupport]

@CraigHRowland Ask any survivor how they feel about their abuse being called “porn.” They don’t. That’s why professionals use CSAM, it’s about respect and accuracy.

You work in security, you know precision matters. Calling CSAM “porn” is like calling a malware payload “software.”

[OsintSupport @OsintSupport]

@CraigHRowland It’s not pornography, it’s child abuse. The fact you don’t see the difference is exactly why terminology matters.

[OsintSupport @OsintSupport]

@CraigHRowland The acronym isn’t about “hiding it” , it’s about accuracy. “Kiddie porn” implies consent or legality. CSAM makes it clear it’s child sexual abuse, not “pornography.” The wording matters because the harm is real.

[OsintSupport @OsintSupport]

@CraigHRowland People love to claim Tor is full of CSAM, but the reality is far darker, most abuse material surfaces on the clear web, social platforms, and messaging apps. Tor isn’t the source of the problem; the open internet is. 2/2

[OsintSupport @OsintSupport]

@CraigHRowland The term “kiddie porn” trivializes real child abuse. The correct term is CSAM (Child Sexual Abuse Material) it’s evidence of a crime, not “pornography.” Words matter. 1/2

[OsintSupport @OsintSupport]

@jaredlander You should check out ClickHouse

[OsintSupport @OsintSupport]

@AIBuzzNews @UnslothAI @xai I have a maxed out MacBook Pro M4 with 128GB of ram for this very reason.

[OsintSupport @OsintSupport]

@FWOsint @UKOSINT @unusual_whales I was working on something a couple of months ago with the same dataset which could predict with extremely high accuracy people who worked at these locations and other so long as they did activities within 1-2 miles. And was close to more than 3-4 of these locations. 3/3

[OsintSupport @OsintSupport]

@FWOsint @UKOSINT @unusual_whales I was able to then identify people who worked at sensitive locations like the Pentagon/CIA/NSA and then their home addresses. Even Putins Palace. It’s not just Americans but even Russians using the app at sensitive bases/locations. 2/3

[OsintSupport @OsintSupport]

[9/9] I might write a full article on this once the run and research are complete.

In the meantime, if you’re interested in the details like methods, performance, tooling, or results, feel free to DM me.

[OsintSupport @OsintSupport]

[1/9] Working on a new and extremely ambitious project.

Generating 208 Trillion Gmail addresses to brute force a hash table of 80M MD5s.

Trying to reverse anonymised emails at scale. Here's how it works and why it matters.

#osint #infosec

[OsintSupport @OsintSupport]

[8/9] Progress snapshot

Scaling well.