The OSINT Newsletter – Issue #117

👋 Welcome to the 117th issue of The OSINT Newsletter. This issue contains OSINT news, community posts, tactics, techniques, and tools to help you become a better investigator. Here’s an overview of what’s in this issue:

• What marketplace listings reveal beyond the item itself

• Where different platforms expose different types of data

• Why low-effort selling often leads to high-value OSINT

• …and whether you can actually sell everything and your grandmother.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Create an OSINT Tool that Constantly Improves

The OSINT Newsletter – Issue #116

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Episode 22: Reply Guys and Robot Toolsmiths: Mining Forums for Long-Term History and Building an OSINT Tool That Improves Itself

Let’s get started. ⬇️

Selling your junk on an online marketplace is just a quick side quest, right? List the item, grab the cash and move on. Little do people know, this low-stakes fire-sale mindset is what OSINT-ers thank them for. After all, who thinks about OpSec when they’re trying to shift their haunted Thai puppet ASAP? Nobody, that’s who.

In this issue, we’re covering how to make the most of the mercantile mindset for OSINT investigations. You’ll learn:

• What marketplace listings reveal beyond the item itself

• Where different platforms expose different types of data

• Why low-effort selling often leads to high-value OSINT

• …and whether you can actually sell everything and your grandmother.

Online marketplaces – like eBay, Craigslist or Facebook Marketplace – function fundamentally differently to non-selling social media.

On a transactional platform, there’s no audience to curate for, and no pressure to perform – unlike social platforms. A user has no timeline to maintain, so they’ll go ahead and sell that handmade Minion fire pit regardless of what people think.

When people aren’t thinking about being observed, they become less concerned with observers. Listings get rushed or photos get taken quickly without thought about what they reveal. Being findable might even be key to the sale, i.e., if the item is too large to post, needs verification, etc.

Locations are usually given automatically in a marketplace listing. There’s also plenty of photo evidence to get stuck into. If descriptions get copied, reused, or written without much creativity, it can also be easy to spot a single seller with many accounts.

Listings with photos and descriptions are super valuable for marketplace OSINT, but they’re just face-value. There’s even more to find if you know where to look. Let’s go deeper into what users are really selling when they post that ad for ‘bob’s burgers hamburger landline phone’.

Seller Behavior

How often does someone post? How do they respond to prospective buyers? How urgently do they sell their items? A desperate plea to ‘COME TAKE THESE FAKE ASS TREES BEFORE I HURL THEM OFF MY BALCONY’ can tell you a lot about a user’s state of mind.

If and when patterns emerge, note if they follow across multiple platforms. Which and how many platforms a user frequents (Craigslist vs Etsy, for example) can also tell you a lot, and help you delineate your subjects: casual declutterer vs. semi-professional reseller vs. someone offloading everything before they skip town.

Product Listings

The aforementioned big-hitter. Descriptions, wording, and types of items sold can offer glimpses into your subjects’ interests, lifestyle, and occupation. Selling a SurfJet motorized surfboard? You’re a watersportsman. Looking to find a goat for a rap video? Chances are you work in music. Listing ‘Giant Oatly Carton @ Global Life Field’? Just gave your location away in the title, buddy. And your lactose intolerance.

Repeated phrasing across listings can also prove useful. Most people have a distinct writing style, and some might outright copy and paste. Not only can noticing these repeat offenders link accounts and identify users, but this OSINT tactic is so powerful that it’s caught serial killers.

Shipping Patterns
Collect-in-person listings are an easy GEOInt win, but if you sell it, you’ve usually got to ship it. Mismatches in locations, dispatch times, and delivery options are just as useful here. Postage details can hint at where someone is actually based – not just where they claim to be.

Condition: Still-shiny, well-organised, fully functional.

Description: The OG marketplace platform. Comes with structured listings, detailed seller histories, and a built-in feedback system that practically does half the OSINT work for you.

Ideal for beginners and professionals alike.

Condition: Handcrafted, bespoke, not ‘old’ just ‘preloved’.

Description: A more personal marketplace. Here, sellers blend commerce with crafting an enviable social-media style identity. Users’ ‘shops’ sell products alongside a broader seller persona – so often link to real names, personal brands, personal e-commerce websites or external platforms like Instagram (for the *aesthetic*, obvs).

Ideal for beginners and professionals. Expect to find users who avoid the other boring marketplaces.

Condition: Local pickup only, no refunds.

Description: Embrace the chaos. Don’t expect to find storefronts here. Listings require real names, real profiles, and zero patience. The pace here’s fast, messy, and… In fact, ignore the items. Check the linked Facebook profiles. That’s where the value is.

Ideal for professionals and more experienced investigators.

1. Analyze Listing Patterns
   Look at frequency, item types, and post timing. Are they selling similar things repeatedly? Clearing out many identical items or many items in a certain category? One Amish wax figure is one thing, but 40 in different sizes…?

2. Compare Seller Profiles
   Cross-reference listings, usernames, bios, and linked accounts across platforms. What do you learn?

3. Identify Reused Descriptions or Images
   It’s unlikely more than one user has a killer female alien they made for art class. Still, finding copy-paste text and identical photos is the easiest way to link multiple accounts or listings. Does this second alien also have a small crack on the side of her ankle? (Don’t worry, you can glue it back together.)

Many investigators are using OSINT to spot scams and missold items. The following are quick-and-dirty ways to identify them.

Boilerplate Listings
Once you spot this, you’ll see it everywhere. We mean beyond the point of a single user copy-pasting to increase exposure. Ten or more listings with the same phrasing, same structure, and different items are probably scammy nonsense. If you’re looking for proof of that – game on.

Stock Images
Alarm bells should ring. Either they’re hiding the real item, or they don’t have a real one to sell. The same goes for AI-generated images.

Unusual Pricing Patterns
Too cheap or oddly fluctuating prices are worth investigating. Remember: pricing often reflects intent. Is $4000 too cheap for a geodesic moon dome?

Nice work. You’ve just cleared out Marketplace OSINT.

Now you should know:

If you’ve checked the listings, compared the profiles, followed the patterns, and questioned what’s actually being shown, you’ll start seeing past the items — and into the OSINT behind them.

As for your grandmother, don’t try to sell her on eBay. People have tried. It’s illegal.

See you next week, investigators!

🏁 New CTF Challenge Live – The Breach

A new CTF challenge has been posted on our CTF website. This week’s challenge involves finding the first and most recent time a threat actor’s email address appeared in public data breaches using a tool featured in our previous newsletter.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “The Fugitive” where participants were tasked with identifying the name of the psychological cabinet where a fugitive had an appointment before disappearing.

Challenge solution WU:

To solve this challenge, participants must use a tool that redirects them to the Google reviews of the provided email address. For that they can use OSINT Industries or GHunt. Querying that email address and checking the Google reviews left by the fugitive, we can find the cabinet name.

Note: They can also do it manually by extracting the GAIA ID, which will lead to the google reviews account.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.