Bellingcat-OSINT-Toolkit

Archive and preserve web content, social media posts, videos, and pages. Capture snapshots, monitor changes, and retrieve historical versions. Use when the user needs to save, archive, or retrieve web content, even if they don't mention "archiving" or "OSINT."

Research companies, business registries, financial records, and sanctions. Search corporate registers (UK, EU, US), offshore databases, trade data, and blockchain explorers. Use when the user mentions a company name, business registration, financial record, sanction, or offshore entity, even if they don't mention "OSINT" or "finance."

Investigate armed conflicts, political violence, weapons, and munitions. Track protest events, military movements, explosive ordnance, and police records. Use when the user mentions a conflict zone, weapons, munitions, political violence, protest, or military activity, even if they don't mention "OSINT" or "conflict."

Analyze, visualize, and organize OSINT data. Create charts, maps, network graphs, timelines, and manage datasets collaboratively. Use when the user needs to analyze collected data, create visualizations, manage notes, or collaborate on investigations, even if they don't mention "data analysis" or "OSINT."

Investigate environmental issues, wildlife crime, deforestation, and climate data. Track illegal fishing, wildlife trade, forest loss, water risks, and pollution. Use when the user mentions deforestation, wildlife, fishing, environmental crime, pollution, or climate data, even if they don't mention "OSINT" or "environment."

Determine where a photo, video, or description was taken. Analyze shadows, sun position, terrain, and infrastructure to pinpoint locations. Use when the user needs to geolocate an image, find a place, or verify coordinates, even if they don't mention "geolocation" or "OSINT."

Verify and analyze photos, videos, and images. Reverse image search, extract EXIF metadata, detect deepfakes/GAN images, perform facial recognition, and analyze video content. Use when the user shares an image, photo, screenshot, or video and needs to verify authenticity, find the source, or identify people/objects, even if they don't mention "OSINT."

Investigate locations using maps, satellite imagery, and street view. Search coordinates, analyze satellite data (Sentinel, NASA, Planet), explore street-level imagery, and compare map services globally. Use when the user mentions a location, coordinates, satellite image, map, street view, or geographic feature, even if they don't mention "maps" or "OSINT."

Entry point for Bellingcat's OSINT toolkit. Maps entity types (ships, planes, people, emails, phones, photos, videos, domains, companies, social media, wildlife, munitions) to investigation categories and tools. Use when investigating any entity and need to find the right open source investigation tools, even if the user doesn't mention "OSINT" or "Bellingcat."

Find information about individuals using names, email addresses, phone numbers, and usernames. Search data breaches, social networks, public records, and people directories worldwide. Use when the user provides a person's name, email, phone number, or username, even if they don't mention "OSINT" or "people search."

Investigate accounts, posts, and activity across social media platforms. Search Facebook, Instagram, Telegram, TikTok, Twitter/X, YouTube, Discord, Reddit, and more. Track usernames, hashtags, locations, and networks. Use when the user mentions a social media platform, username, hashtag, or social media post, even if they don't mention "OSINT."

Track and investigate ships, aircraft, trains, and vehicles. Monitor vessel movements (AIS), flight paths (ADS-B), rail networks, and license plates. Use when the user mentions a ship name, IMO/MMSI number, flight number, tail number, aircraft registration, vehicle, or train, even if they don't mention "transport" or "OSINT."

Investigate domains, websites, IP addresses, and web infrastructure. WHOIS lookups, DNS history, IP geolocation, content archiving, and technology fingerprinting. Use when the user mentions a domain name, URL, IP address, website, or web infrastructure, even if they don't mention "OSINT."