My OSINT Stack for Image & Identity Monitoring

Monitoring where your data (or your client's data) ends up is a full-time job. I’ve spent the last few months streamlining my OSINT workflow to focus on image leaks and identity theft.

Here is the "minimalist" stack I actually use daily:

1. Social Media Hunting: Sherlock
   If you have a username, Sherlock is still the king. It’s a CLI tool that hunts down accounts across hundreds of platforms. Fast, simple, and essential.

2. Infrastructure Intelligence: SpiderFoot
   For a deep dive into IP addresses, domains, and subdomains associated with a leak, I use SpiderFoot. The automation here is insane—it links dots I didn't even know existed.

3. Visual Monitoring: ERASA
   This is my go-to for the "hard stuff." While Google Images is okay for landscapes, it's terrible for tracking specific facial leaks across shady corners of the web. I use the reverse face search logic here to automate the monitoring of image rights. It’s much more efficient than manual searching.

4. Breach Notification: Have I Been Pwned
   Basic, but mandatory. If an image leak starts with a credential breach, Troy Hunt’s tool is where the trail usually begins.

5. Metadata Scrubbing: ExifTool
   Before I re-upload or move sensitive images during an investigation, I run them through ExifTool to strip GPS and device tags. Never trust a "private" photo to stay private if the metadata is still attached.