Osint Case Studies: Comments news update

OSINTsearch launched an index and methodology series covering twelve open-source intelligence case studies and practical guides based on public cybercrime records. The project, detailed in osintsearch.org's report, examines identifiers printed in court filings, US Treasury sanctions entries, and investigative reporting across charged, convicted, or sanctioned individuals. In September 2026, researchers ran those historical identifiers through automated lookup tools to test how far published email addresses and aliases still travel across live digital platforms today.

This breakdown reviews the empirical findings across prominent threat actor profiles, outlining the specific mechanics of digital footprint analysis for security researchers, forensic analysts, and investigators. The analysis contrasts burner personas with personal mailboxes, maps handle collisions across common and coined names, and details the ethical constraints required when cross-referencing live internet registrations against judicial records.

01Automated lookup across live platforms

The investigative workflow begins strictly with primary public documentation, such as an indictment, complaint, affidavit, sentencing memorandum, or Office of Foreign Assets Control entry. Investigators copy each published string letter by letter, noting that even minor character discrepancies between reporting iterations alter search outcomes completely. Identifiers circulating exclusively on unofficial online forums without primary source documentation are excluded from the query pipeline.

Each verified email address is processed through an email lookup system checking approximately 175 online platforms for active registrations and exposed profile data. Platform returns often surface connected GitHub handles, display names, and account creation dates. Any discovered username is subsequently submitted to a dedicated username search scanning approximately 760 services, after which every resulting timestamp is placed against the formal legal case timeline.

02Public records across twelve studies

The published series contains twelve distinct pieces, divided evenly between six individual group case studies and six topical technique guides. Individual case breakdowns track entities such as Scattered Spider, TeamPCP, and major ransomware operations from initial forum presence through judicial charging. The remaining six technical guides examine operational patterns, including tracking burner addresses, mapping group handles, and extracting contact metadata embedded directly within sanctions lists.

The case corpus evaluates multiple high-profile legal filings, including sixteen individuals tied to Scattered Spider across American indictments and British Transport for London prosecutions reported by Krebs. Additional analyses assess Colton Grubbs, who received a 30-month sentence in 2018, and Maksim Galochkin, who was sanctioned on September 7, 2023, and named in three separate indictments. The documentation also covers Joel Martin Evans, sentenced to 24 months on August 27, 2026, alongside Dmitry Khoroshev, Ruben Ian Thomson, and cases involving Fitzpatrick, Coelho, Buchanan, and Rudometov.

03Footprints of personal and burner mailboxes

A central empirical pattern across the case studies is that everyday personal mailboxes generate extensive digital trails, whereas isolated persona addresses rarely return external platform registrations. In the Fitzpatrick case, an affidavit cited a Riseup address used for RaidForums registration that yielded zero external platform matches, while a personal Gmail account tied to him returned 11 platform registrations. Similarly, in the TeamPCP case, an address tied to the BreachForums Express account yielded no external registrations, while a personal Gmail account linked by Krebs to Thomson returned 24 results.

Username lookups demonstrate that coined strings function as unique identifiers while common dictionary words generate widespread noise. A search for the coined handle volhvb produced 11 exact matches, joeleoli returned 33 exact matches, and deadcatx3 yielded 21 exact results, including a reported HackerOne profile. Conversely, common dictionary words generated extensive collisions, with Express returning 316 exact matches and the TrickBot alias mango returning 439 hits, demonstrating that generic words cannot establish attribution without secondary anchors.

04Verification through timestamps and anchors

Direct email links provide stronger evidential weight than unverified username matches across third-party networks. The fictional detective handle nerowolfe produced 113 exact matches across the web, yet only one account on GitHub linked back to a public record address and matched the persona Krebs tied to Khoroshev. Similar email anchors resolved public addresses for Grubbs and Maksim Rudenskiy directly to GitHub profiles displaying their respective real names.

Account creation dates serve as an objective profile metric that cannot be modified by the account holder. On the lockbitsupp alias, a Steam account dated from 2004, existing years before the ransomware group emerged, while a Codeforces account surfaced five days after the unsealing of Khoroshev's indictment. In the Evans case, a GitLab profile displaying his name dated from September 2017, prior to the admitted conspiracy, whereas a MyAnimeList account under the same handle appeared roughly 21 months after the arrest.

05Legal documentation and investigative standards

Investigators must identify the precise legal document that prints an identifier, as disclosure practices vary widely across jurisdictions. The Khoroshev criminal indictment omitted email addresses entirely, whereas the corresponding OFAC sanctions listing published two specific addresses. In Scattered Spider proceedings, British and European authorities released names, ages, and sentences without handles or mailboxes, requiring researchers to rely on American court filings and named journalistic reporting to extract search strings.

The research framework enforces strict operational boundaries, limiting subjects exclusively to individuals publicly charged, convicted, or sanctioned. The methodology maintains a strict presumption of innocence for charged individuals who have not been convicted, completely excludes minors and victims from publication, and withholds unpublished third-party usernames surfaced during testing. Furthermore, a null lookup result is treated solely as an absence of platform records rather than proof that an account never existed.