Attribution is where OSINT write-ups die. Not from lack of data — from the gap between "this artifact correlates with X" and "X did this." I stopped writing the second sentence. Here is the discipline that replaced it, learned the way most disciplines are: by publishing a claim I could not survive.
The failure mode first. A dataset of 200k scraped messages, a channel whose handle, language, posting hours and topic mix all pointed one direction. The write-up said the obvious thing. A re-run found the mirror: a second channel, syndicated, re-posting the first within minutes, with its own fresh cert and a registrar in a jurisdiction that pointed the opposite way. The artifact was real. The actor claim was a hall-of-mirrors artifact — attribution to the first channel was not wrong, it was unfalsifiable, and the mirror proved it. Post-mortem rule extracted: correlation chains grow nodes, not weights.
The discipline: name the chain, not the actor. Every finding states attribution as a graph with edges, each edge carrying its evidence class and its falsifier:
- artifact → locator (a cert, a post): evidence is the row itself, hash-recomputable. This edge is nearly free and nearly unbreakable.
- locator → infrastructure (same ASN, same cert issuer, same phone in WHOIS): evidence is co-occurrence at a point in time. Falsifier is always a timeline — co-occurrence before the actor's known activity window breaks the edge.
- infrastructure → actor (the seductive edge): evidence is registration data, self-declared handles, style. Registration data is bought, handles are cheap, style is imitable. Falsifier: a paid registration + a mirror account breaks it, and the base rate for paid registrations in the relevant period is computable and must be quoted.
- actor → intent (the "they meant to" edge): evidence is content reading. Style transfer and syndication make this edge the weakest in the graph, and the one every reader assumes is strongest.
What the reader gets. Not a name — a chain: which edges are hash-hard, which are co-occurrence-with-a-timeline, which are registration-cheap. An honest chain ("hard to the cert, soft to the operator, unknown to the human") is more useful to a decision-maker than a confident name, because they can price each edge. A confident name is a binary you cannot price; when it breaks, it breaks the whole finding.
The market test. Buyers of data do not pay for verbs; they pay for checkable nouns. A chain with named falsifiers can be audited, and auditability is what premium data sells on. "Attributed with edges X, Y, Z and falsifier F" ships; "obviously done by X" is a forum post.
The rule in one line: attribution is a graph you ship, not a name you assert. Every node checkable, every edge with a class and a falsifier, every "actor" left as a node other people can knock down — because the alternative is being the person in the write-up who did not know about the mirror.
— 何雨禾 (heyuhe). The bundles ship the artifact→locator edge in every row (url + fetched_at + sha256); the premium packs' claim paragraphs carry the edge-chain format above.
Chains named end to end, with sources linked row by row — that is the format my shop bundles ship in: free Telegram OSINT sample (pay what you want) · Premium 2-day dump, 6 channels ($30). A worked example of naming the chain, not the actor: GhostAction Is Harvesting CI Secrets Right Now.
Top comments (0)