Pivoting is one of the most important investigative skills.

You can use fancy tools to obtain an email from a real name, for example, but you need to know the next steps. This applies to other selectors (personal identifiers), like usernames, phone numbers, etc. You must know how to move from one piece of information to the next. Otherwise, you'll get stuck in your investigation.

This newsletter issue will teach you how to find new selectors from the one you have. It will also show you what to do when you hit a dead end.

Pivoting in OSINT

OSINT workflows can be complex. Depending on what data you have, it opens up certain avenues. I will share OSINT cheat sheets that will simplify your process tenfold. These are workflow diagrams done by expert investigators. Use them in your next project. They are great for pivoting.

The first diagram I shared is linear and serves as a good entry point before we move into more complex flows. This digital footprint diagram shows what information you can gather from an online account.

Email pivoting

Let’s say you have found an email address and want to uncover more personal identifiers. You might find connected social media accounts, breach data, archived content, and more. Here is a useful diagram to discover more workflows:

The diagram above is divided into two parts: search and content analysis. The former is useful for uncovering linked accounts. The latter is an essential pivoting technique. It allows you to extract a username from an email, which might reveal new leads when you're stuck.

Investigators also have different methodologies. For example, Griffin Glynn covered email investigation in a slightly different way. He created a separate flow for validation. Additionally, he listed email OSINT tools (rounded squares). Don’t confuse these tools with techniques, which are written in boxes with two vertical lines on the sides.

To get a better grasp of this workflow, read Griffin’s article on email pivoting. It explains each section of the flow in detail and displays them separately in higher resolution.

Michael Bazzel has a similar flow, and I really appreciate diagrams from Inteltechniques because they are well interconnected. They show that you can pivot from email to username in two ways:

1. Run the email on search engines to find websites or social media platforms where it was used. Then, extract the username from those accounts.
2. Remove the domain part of the email and treat the rest as a username. While this might not be as reliable (since you're essentially guessing), many people do reuse usernames in their email addresses.

The workflow chart above mentions search engines and document search. To utilize these resources efficiently, you need to know advanced search queries. Here are some good examples to put in search engines that support advanced queries:

• "email@example.com" filetype:pdf – Look for PDFs containing the email.
• "John Doe" filetype:pdf – Search for names in documents.
• "email@example.com" AND "contract" filetype:docx – Search for a combination of email and a specific term within business documents.

Pivoting from personal information

As I already mentioned, investigators approach things differently. Maciej broke down personal information, vehicle details, physical location, and other points of interest into separate diagrams. On the other hand, Sinwindie combined them all into one cohesive diagram.

Pivoting flows

Email → domain name → linked domains

1. Email Search: Use search engines to find websites or social media profiles linked to the email address.
2. Domain Name: Extract the domain from the email (e.g., @example.com) and search for it to uncover associated websites or services.
3. Linked Domains: Use reverse WHOIS to find other domains registered with the same email or organization.
4. DNS Records: Use passive DNS to find related domains sharing the same IP address.
5. Hosting & SSL Certs: Look at common hosting providers or shared SSL certificates to find other associated domains.

Username → social profiles → location

1. Username Reuse: Search for the same username across different platforms to find linked social profiles.
2. Metadata Analysis: Look at images or posts for location data or other identifiers.
3. Friends & Followers: Investigate connections to identify linked accounts or additional information.
4. Social Profile Data: Analyze profiles to uncover location, job, or other details that can help triangulate physical location.

Phone number → social profiles → email address

1. Phone Number Lookup: Use services or search engines to find social media profiles linked to the phone number.
2. Social Profile Data: Analyze profiles for email addresses, usernames, or location details.
3. Email Investigation: Take the part of the email before the “@” and treat it like a username. This will open a new path for investigation and uncover new accounts you might not have obtained otherwise.
4. Online Listings: Search for phone numbers in public databases, ads, or online directories to uncover additional contact information.

These workflows are great for pivoting between different pieces of information to uncover more about an individual or entity.

Iterate your process. Each new piece of information can serve as a starting point for further investigation.

I’ve covered the main topic of the newsletter. Let’s move on to recent updates in the OSINT community.

Awesome projects

I like new initiatives and when people create their own projects. One of the recent projects is gangmap.com. It's an aggregation of gang maps, territories and activities made by Reddit users.

Gang maps are valuable for crime researchers because they provide detailed geographical insights into gang territories and activities. This information helps identify patterns, trends, and connections between gangs and locations. Researchers can use these maps to track crime hotspots, monitor gang movements, and conduct analysis for crime prevention or law enforcement purposes.

The homepage displays a list of gangs and links to Google Maps that display detailed information about territories and activities.

This project was created by Nathaniel Fried, who regularly participates in OSINT events and shares his knowledge. His next webinar, on April 9th, will focus on tracking FSB agents. Learn practical skills by watching a live investigation — sign up for the webinar.

Insightful articles

Not many write about the intelligence mindset. Analyzing information and turning it into an intelligence product requires a rigorous approach. Vance Poitier is one of the writers who extensively cover this topic. You might know him as VEEXH on Medium.

1. OSINT: Analyzing Modern Propaganda – An overview of propaganda, explaining how modern digital platforms exploit cognitive biases to manipulate public opinion.
2. The Most Underrated Skill for OSINT – This article covers the importance of mindset in intelligence work. Tips on how to focus on reducing cognitive strain and prioritize relevant information.
3. How to Master OSINT in the Era of Artificial Intelligence – This article views OSINT as a framework for self-awareness and overcoming biases. Read it to find out how to stay ahead of AI.
4. Polymath Study Habits for Learning Open Source Intelligence – This article explains how being a polymath (know multiple disciplines) helps with OSINT. It highlights methods and gives practical tips on how to study smarter, not harder.
5. The Darknet an Unconventional Source of CAI – This article shows how the Darknet serves as a valuable source of OSINT. It covers how analysts use structured frameworks to analyze data from leaks and dumps, turning them into actionable intelligence.

Also, read the latest articles from OSINT experts published on our platform. We help writers craft great articles and promote them to our wide audience. Write with us and publish an insightful guide like these:

Passive Subdomain Enumeration: Uncovering More Subdomains than Subfinder & Amass

Subdomain Center notes over 200 competitors, yet Amass integrates 87 and Subfinder 45; this article explores better subdomain enumeration tools.

OSINT Team - Learn OSINT from expertsAyush Singh

Unmask the Scam: OSINT Secrets to Catch Phishing Emails Like a Pro

Scammers use phishing attacks to steal data and money, leaving victims with little recourse. This guide will teach you how to investigate phishing scams, analyze malicious files, and track down fraudsters using open-source tools.

OSINT Team - Learn OSINT from expertsThomas Caliendo

Investigating Economic Crime Like a Pro: Tools, Tradecraft, and Methods for OSINT Analysts

Follow the money, uncover hidden networks, and expose economic crime. Learn the OSINT methods to map financial crime like a pro.

OSINT Team - Learn OSINT from expertsBrett R

Conclusion

Now you can pivot and have a better idea on how to produce intelligence. By the way, I already discussed the intelligence mindset. Seems like this newsletter issue naturally expands on what I covered previously:

The Practical OSINT Newsletter. Issue #2.

This issue will help you to improve your people investigation skills and teach practical OSINT techniques. It will also sharpen your intelligence mindset for more effective analysis.

OSINT Team - Learn OSINT from expertsPetro Cherkasets

Expect the next issue in July.

If you like our platform and approach to education, you can submit a guest newsletter post. For us, it will make it possible to release a new issue before July. For you, it’s a great opportunity to expand your audience and gain more authority in the OSINT community.

Find our email at the bottom of Support us page. Looking forward to hearing from you!