Week in OSINT #2023-28
Welcome to another Week in OSINT, with some insights into Twitter, a nifty Google trick, an OverPass Turbo tool, and other news.
This Monday I have another small update from my side, due to lots of work. I wish I had the time to write longer updates, but maybe it isn't so bad to keep these short. Else all my readers would only be playing with new tools and tricks the whole week, and never be able to have any work done! Anyway, I did manage to dig up a few interesting things I read last week:
- More on Twitter
- Google Site Operator
- GeoPincer
- Google Analytics 4
- Uniform Timezone
News: More on Twitter
Another blow for researchers that are monitoring Twitter users. Since some time ago there have been some serious issues with the platform. It has been extremely unstable for some period last week. New tweets weren't loading, and I received error messages when I wanted to view a specific tweet. Last week it was even impossible for some time to search on specific tweets with a basic search like: to:sector035. This has been going on since Musk fired loads of engineers, and it might even get worse in the future.
Besides the issues that are the direct result of a lack of engineers, there are also changes that make the platform unusable for researchers. First, there is the issue of rate limiting that stops you from seeing anything more than a few hundred tweets a day.
Another issue that I noticed on Sunday, July 9, was that it seemed to be impossible to retrieve a full list of followers or followed accounts. The list only loaded the first few dozen accounts, and then stopped. Was this limited too? Or was this another 'temporary' issue? We actually might never know.
A third issue that was mentioned early July, was the rumour that Twitter stopped Google indexing its content. This is actually not true, and it is believed that it might be due to the rate limiting that Google temporarily showed less information. Luckily, Twitter made some changes and things are looking better at the moment, since the most recent tweets are available again in Google! That also opens up the door for some very basic monitoring, without being logged in. Only a handful of tweets are shown, but it is possible to view the latest content of an account, by setting the User-Agent to a Google bot.
Other positive news is that both Archive.today and the Internet Archive, are able to archive single tweets or profiles. For some time, that was also unavailable, but that is also back!
Twitter is still an important resource when it comes to alt-right movements, fake news spreaders, and troll farms. And since the big lay-off over at Twitter, things have been increasingly unstable. Some things seem to have been resolved, other issues require some workaround, but it seems that it will never return to what it was. Make the best of it, and keep on digging!
(until you are rate limited, of course...)
Tip: Google Site Operator
I was having some issues last week with the site: operator in Google, but only when I was logged. No clue what was wrong, but it has actually been solved, and everything works again. But during my searches, I saw a message over on Mastodon by Alex Ștefănescu (/), a developer over at OCCRP.
This simple Google search can be used to find specific content in a Facebook about section of a profile. Really nice tip from Henk van Ess here, thank you for sharing this!
Link: https://gijn.org/2023/06/26/...
Tool: GeoPincer
One of the handy tools one can use during geolocation, is OverPass Turbo. The query language is not the easiest to learn, but once you get the hang of it, it is really powerful! The Reddit user tholo2k has created a nifty Python script that will query a location, and give a list of specific named 'amenities' that are within a given distance from each other. An awesome little tool, easy to use, and might help a lot of people looking for a specific location.
I did receive an error message when I ran it the first time though. So if you are hitting a wall, maybe try and upgrade the urllib3 and requests. This worked for me:
python -m pip install -U urllib3 requests
Link: https://github.com/tloja/GeoPincer
Article: Google Analytics 4
Google Analytics as we know it, is no longer... Of course, there are still a lot of websites that haven't transitioned to the new 'GA4', and you can still find connections using the already known tools. And a legacy UA-ID is still possible, according to Google. But the new analytics, or 'Google Tags', are quite confusing. In this article by Craig Silverman (/), everything you need to know, including some tips for future investigations. One thing that doesn't change, is de-anonymising dedicated servers by searching for specific analytics codes
Link: https://digitalinvestigations.substack.com/...
Tool: Uniform Timezone
Bellingcat created a new browser extension for Chrome, called 'Uniform Timezone'. After installing, and reloading a Twitter of TikTok page, you can hover over any time mentioned on that page. It will then tell you the time in different formats in a small floating information box. A simple click on any of the values will copy that value to the clipboard, and you can also set a custom time zone if you have a need for that. Wonderful, and simple, tool for Chrome that surely will come in handy! Thanks swedishmike for sharing that!
Link: https://github.com/bellingcat/uniform-timezone
Link: Chrome extension
FUNINT: This Week's Meme
This week, I focus again on Twitter, the ongoing changes and stability of the platform. This platform just keeps on giving!
PS: I think that it's about time that Chad Warner adds "FUNINT" to his list of disciplines too:
Funny intelligence. Involves gathering enough data on the current landscape of OSINT, its process, or the tools used, to make fun of it.
Have a good week and have a good search!
