The OSINT Newsletter – Issue #111

👋 Welcome to the 111th issue of The OSINT Newsletter. This issue contains OSINT news, community posts, tactics, techniques, and tools to help you become a better investigator. Here’s an overview of what’s in this issue:

• What you can uncover from company data

• Where to dig (without finding trouble)

• A clean investigative workflow

• …and how to win, bigly.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Using Generative AI for Sock Puppet Creation and Identification

The OSINT Newsletter – Issue #110

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Episode 20: Boring Records and Better Bots

Let’s get started. ⬇️

Welcome to the boardroom – but you’re not here for the pitch.

You’re going to be playing (if you’re British) Sir Alan Sugar, or (if you’re American) He Who Will Not Be Named. That’s because we’re talking about the business end of OSINT. For this week’s task, you’ll be doing open-source company intelligence.

Lucky for you, you’re not here to judge questionable branding, nonsensical messaging or claims that your new apprentice “tastes success in his spit when he wakes up.” You’re here to find out: Who actually runs this thing? Where does the money flow? What’s going on behind the scenes that the owner would rather keep hidden?

Get it right, and you’ll be raking in the data. Get it wrong, and your investigation will feel a bit like an episode of The Apprentice after all – where you’re the one getting fired.

This issue will teach you:

• What you can uncover from company data

• Where to dig (without finding trouble)

• A clean investigative workflow

• …and how to win, bigly.

Let’s stick to talking about The Apprentice. Think of a company like a task team. It’s one unit on the surface, but underneath, there’s power dynamics, complicated relationships and a whole lot of questionable decisions.

Who’s officially in charge? Companies might claim that it’s one party, but only the OSINT tells the whole truth. Directors, shareholders and incorporation data are your friends.

The names listed in filings are real people with histories, often across multiple companies. And some of them are about to look very busy. If somebody’s listed across a vast number of companies, or where they shouldn’t be, you might have your hands on gold dust.

There are many types of companies, and many ways they can connect. Sometimes the ‘company’ you’re looking for is a fragment of something bigger. Some companies turn out to be subsidiaries or shell layers, turning your investigation on its head.

There aren’t really ‘tools’ in the traditional sense – more like places to look. Still, anything’s a tool if it’s useful enough.

Start with official filings (e.g. Companies House in the UK, SEC filings in the US, or equivalent national registries). Here’s where to find director lists, registered addresses and filing histories.

Platforms like OpenCorporates and Sayari pull together records across jurisdictions to help you zoom out. Useful when companies start hopping countries or operating through multiple entities. Ask: Who owns what, across borders? Who keeps showing up? Why would they move this way?

Yes, really. Of course they’re curated, but “About Us” pages, leadership bios, press releases etcetera are still useful. Especially for confirming roles and timelines against official filings.

Time to get structured. It’s your job (pun intended) to investigate a company. Let’s follow an OSINT workflow from beginning to end.

Looking for a company? Lock in the legal entity first. You need an exact name (even if it’s not the one you thought), registration number, and jurisdiction. Get these wrong and you’ll be investigating the wrong ‘company’ altogether. Remember Four Seasons Total Landscaping?

On The Apprentice, everyone says they’re a “born leader.” Let’s find out who’s actually in charge. Pull every listed director and office, then start connecting them. Who appears across multiple companies? Who’s moving between roles? What does this suggest in terms of your investigation?

Trace ownership up and down, as well as side to side. Investigating vertically as well as horizontally can show the loudest brand isn’t always the one with control. Unexpected shell, parent or subsidiary activity is a relatively common find with bigger corps at this stage.

Compare everything. Names, addresses, timelines, jurisdictions, employee handsomeness.. If multiple entities share the same details, you’ve got a pattern — and hopefully a breakthrough. Visualisation tools like Maltego can really help here

Who’s the boss? Directors make great pivots. LinkedIn profiles and previous ventures are great ways to take the investigation personally.

Where are they? Shared offices can link entire clusters of companies. Especially useful for spotting shell setups or service-provider hubs.

Who are they working with? Suppliers, parent firms or collaborators can expand your map fast.

Your team just won that one. You’re the boss of company OSINT.

Now you should know:

• What you can uncover from company data

• Why you should start with the precise legal entity

• How directors are your bridge to people

• Clear ways to get to the good stuff

If you’ve checked the filings, mapped the players, followed the structure, and tested the story against what’s actually recorded, you’ll get exactly what you need. Here’s to investigations that smell like Success.

Here’s what you’ve been waiting to hear: You’re hired.

See you next week, investigators!

🏁 New CTF Challenge Live – Disguised Fuel Convoy

A new CTF challenge has been posted on our CTF website. This week’s challenge involves identifying a location from a low quality Telegram video and using visual clues to determine the nearby gas station name.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Red Notice” where participants were tasked with investigating the company details of a financial actor who is wanted by INTERPOL under a Red Notice.

Challenge Solution WU :

Searching for the full name, we get a result from pappers.fr. Looking at the public records, we can see the date of registration of the first company that was first is still active until this day, just under that we also find the company name.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.