OSINT OR NOT ?!!
OSINT / THREAT INTELLIGENCE

Separating signal
from mirage.

An independent threat intelligence initiative analyzing, verifying and unmasking cyber operations, APT campaigns and digital deception. No noise. No speculation. Only evidence.

ENTER INTEL FEED → OUR METHODOLOGY
EGYPTIAN RESEARCH TEAM VERIFIED REPORTS SECURE INTEL DROPS
LATEST INTELLIGENCE

Fresh from the databank.

VIEW FULL FEED →
2026-09-27 UNMASKED

Unmasking RedFoxIQ : How Immutable IDs and Screen Recordings Exposed an Iraqi Threat Actor

TARGET RedFoxIQ

RedFoxIQ, an Iraqi threat actor responsible for extensive database exfiltrations, was successfully de-anonymized as Ahmed Ali Ismael Al-jebori due to critical operational security failures. Investigators uncovered his true identity by tracking immutable Telegram IDs, reused cross-platform handles, exposed GitHub metadata, and careless screen recordings that revealed his real name and phone number.

10 MIN READ OPEN ↗
2026-09-19 UNMASKED

Unmasking $WUMP: Exposing the Operator Behind the Fake Discord Airdrop

TARGET $WUMP

$WUMP airdrop—masked behind abused German server locations—ultimately unraveled across$HIPO and ZYNC due to leaked Iranian connection telemetry and sloppy infrastructure sharing. These compounding OPSEC failures directly unmasked the operation's sole architect, 37-year-old Iranian operator Mostafa Forouji.

8 MIN READ OPEN ↗
OPERATING PRINCIPLE

Evidence in. Noise out.

01

Collect

Raw telemetry, artifacts and public records gathered across the open web.

02

Analyze

Zero-trust analysis. Corroborate every claim. Separate signal from mirage.

03

Report

Actionable intelligence with defanged IOCs, clear attribution and no speculation.

INVESTIGATION COVERAGE

What we investigate.

OSINT OR NOT ?!! focuses on the parts of cybercrime that are hardest to fake: identities, infrastructure and money. Every investigation starts with a question that can be answered by evidence — a reused handle, an exposed commit, a leaked credential, a wallet cluster — and ends with a report that shows the chain of reasoning instead of asking readers to trust a conclusion.

Threat actor unmasking

Attribution built from immutable identifiers: Telegram user IDs, GitHub commit metadata, reused avatars, domain registration history and cross-platform handles. We separate the operator from the persona and document every pivot.

Ransomware & extortion

Tracking leak-site activity, negotiation patterns, affiliate relationships and infrastructure reuse across MENA and global campaigns, with defanged indicators and practical detection notes for defenders.

Infostealer & credential exposure

Analyzing stealer logs, combolists and breach corpora to map credential reuse, session exposure and the operational security failures that connect malware samples to a real operator.

Crypto fraud & social engineering

Following airdrop scams, wallet drainers, fake Discord servers and OAuth abuse from the original lure to the cash-out, including wallet clustering, platform artifacts and victim impact.

VERIFICATION STANDARD

One source is never enough.

Open-source intelligence has a credibility problem. Screenshots are easy to fabricate, aliases are easy to recycle, and a single uncorroborated Telegram message can travel further than a correction. Our methodology is designed to resist that failure mode.

Every claim in a published report must be supported by at least two independent artifacts, or by one artifact that is cryptographically or platform-verifiable — an immutable account ID, a signed commit, a DNS record or a blockchain transaction. We preserve raw captures, timestamp each pivot and state plainly what remains unproven. When a lead collapses, we document the false positive instead of quietly deleting it.

We do not pay sources for attribution, we do not publish doxxes of private individuals, and we redact personal data that is not necessary to the investigation. Reports are reviewed by a second analyst before release, and corrections are appended with a date rather than edited away.

Security teams use the feed to prioritise patching and detection engineering. Journalists use it as a verified starting point for their own reporting. Researchers use the methodology as a worked example of attribution without speculation. If you defend an organisation in the MENA region — or investigate an actor who targets it — this feed is written for you.

FIELD NOTES

Questions we get asked.

What is OSINT OR NOT ?!!?

OSINT OR NOT ?!! is an independent threat intelligence initiative that investigates cyber operations, unmasks threat actors and publishes the evidence behind each attribution. We work from open sources: public records, platform metadata, leaked data, blockchain transactions and infrastructure fingerprints.

How do you verify an attribution before publishing?

We require corroboration before naming anyone. Depending on the case, that means immutable platform IDs, commit metadata, domain or certificate history, wallet clustering, or consistent infrastructure reuse. Every report states the evidence, the confidence level and the remaining gaps.

Which threats and regions do you cover?

We cover threat actor unmasking, ransomware and extortion, infostealer and credential leaks, crypto fraud and social engineering. Our geographic focus is MENA and the GCC, but we follow operations wherever the infrastructure leads.

Can I send a tip or request an investigation?

Yes. Use the secure contact channel to send a lead, an artifact or a request for incident support. Sensitive material can be encrypted with our PGP key. We do not pay for attributions and we protect source confidentiality.

Is the intelligence feed free to read?

The public feed is free. Reports are published when they meet our verification standard, not on a fixed schedule, so the cadence follows the evidence rather than a content calendar.

SECURE CHANNEL

Have intelligence worth verifying?

Open a secure channel with the research team. Sensitive drops can be encrypted with our PGP key.

CONTACT THE TEAM →