These OSINT case studies start where the investigators finished. Every email address and alias in them was first printed by a court filing, a US Treasury sanctions entry or named investigative reporting, about a person who has been charged, convicted or sanctioned for cybercrime. In September 2026 we ran those identifiers through the OSINTsearch email lookup and username search, then wrote up what came back. This page indexes the series: what each post covers, the technique it teaches, and the lessons that hold across cases.
Each post takes identifiers that are already public and asks two questions. How far does this address or alias travel on live platforms today? And what does that teach about investigation method? Six posts follow one case or group, from Scattered Spider to TeamPCP. Six are guides that draw on several cases to teach one technique. Together they work as OSINT investigation examples with every input shown.
