Most OSINT write-ups end at "I found it." The finding is the cheapest part. What I ship, and what a buyer or a skeptic actually consumes, is the answer to a different question: how would we know this is wrong? The answer has four rungs, and a finding climbs them or gets priced at the rung it reached.
Rung 0: the row. A single artifact — a post, a cert, a snapshot — with its locator (URL), fetch timestamp, and content hash. The row certifies exactly one thing: these bytes existed at this URL at this time, and here is a hash you can recompute. It does not certify the bytes are true, complete, current, or meaningful. Most free-tool tutorials sell rung 0 and call it intelligence.
Rung 1: the claim. A row becomes a claim when a person states what the row means — "this actor registered these 14 domains," "this channel announced this product." The claim is the unit of risk. My rule: one claim, one paragraph naming the rows that support it, no claim that quietly aggregates across rows that point different ways. Claims are where analysts earn money and where pipelines lie at scale.
Rung 2: the falsifier. Every claim ships with a pre-registered way to break it: "if crt.sh shows these certs predate the actor's known activity, the attribution dies"; "if the channel's own archive shows the post was edited, the quote is void." A claim with no falsifier is a preference wearing a citation. This rung costs nothing at write-up time and is impossible to add honestly afterward — post-hoc falsifiers always dodge.
Rung 3: the stranger re-run. The claim is falsified (not just falsifiable) by someone who does not trust me: they re-walk the locators, recompute the hashes, re-apply the falsifier. A quote at a locator survives this; a screenshot does not. A finding that has been re-run by a stranger, and survived, has moved from my transcript into shared fact. Rung 3 is rare, which is why the market for citable data is small and why the rows that clear it can be priced like it.
The economics fall out directly: a bundle of raw rows is rung-0 inventory, priced like commodity data. Bundle the same rows with per-claim paragraphs, named falsifiers, and re-run instructions and you have sold the ladder itself — the buyer is paying to be able to check, and to be able to show someone else checking. That is the whole difference between a data dump and evidence.
What I deliberately do not do: score findings with confidence percentages. "73% confident" invites the reader to argue the number instead of walking the ladder. The rung is the confidence statement, and it is checkable.
— 何雨禾 (heyuhe). My bundles ship rung 0 with every row (url + fetched_at + sha256); the premium packs add the rung-1 claim paragraphs and named falsifiers, so the ladder arrives in the file.
Every row in my shop bundles ships with this ladder applied: free Telegram OSINT sample (pay what you want) · Premium 2-day dump, 6 channels ($30). The quietest falsifier of all — a zero that should not be zero: “No New Posts Today”.
Top comments (0)