OSINT Tracking: How Investigators Trace Vehicles, Ships, Aircraft & Radio Signals

This article is based on the talk "OSINT Tracking: The Subtle Art of Not Giving a F**" by Sagar Tiwari (independent security researcher and OSINT investigator) and Shubham Kumar (Senior Information Security Analyst at TransUnion) at BSides Mumbai 2024. You can watch the full session on YouTube. The techniques below are shared for educational and defensive purposes only.*

You are sitting in your chair with nothing but a browser open, and from there you can watch a live CCTV feed on the other side of the world, or follow a giant cargo ship across an ocean in real time. That is not a scene from Mr. Robot - it is open-source intelligence, and Sagar Tiwari and Shubham Kumar spent their BSides Mumbai 2024 talk showing just how much of the physical world is quietly broadcasting its location to anyone who knows where to look. Their throughline: OSINT is not magic and it is not hacking. It is publicly available information, patiently connected into a story.

Key Takeaways

• OSINT is analysis, not exploitation. Every technique in the talk uses publicly available data - no systems are broken into. The skill is in pivoting from one small detail to the next until isolated facts become a complete picture of a person, vehicle, or vessel.
• The physical world is constantly transmitting. Ships broadcast their identity and position over AIS, aircraft over ADS-B, and radios across the spectrum - and web-based receivers make all of it accessible from a browser, no special hardware required.
• Your own posts are the richest source. A photo of a boarding pass, a car with a visible number plate, or a daily Snapchat location does more of the attacker's work than any tool - which is exactly why understanding these techniques is the first step to defending against them.

What OSINT Actually Is

OSINT - open-source intelligence - is the practice of collecting, analysing, and disseminating information from publicly available sources. Because that information is already public, it is fast: it "spreads like fire". And it is used by everyone, the speakers noted - threat intelligence teams, law firms, militaries, and government agencies alike. The same power that makes it useful to investigators makes it dangerous in the wrong hands, which is why they opened with a real and grim example of a public social-media post being used to locate someone.

The 101s: Sock Puppets, Reverse Image Search & CCTV

Before the specialised segments, Sagar and Shubham covered the foundational techniques that plug into everything else:

• Sock puppet accounts. An investigator never uses their real identity. A "sock puppet" is a throwaway alternate persona - built with temporary or region-specific email addresses and matching profiles on Instagram, Facebook, and X - always operated from a virtual machine over a VPN or Tor so the investigator's own footprint is never traced back.
• Reverse image search. A single photo can reveal a location. The speakers cited cases where investigators geolocated a room from a picture of an electrical wall socket, and identified a building from an elevator control panel. Different reverse-image engines are stronger in different regions, so the choice of tool depends on the target.
• CCTV footage. Internet-connected search engines like Shodan, Censys, and BinaryEdge - along with repositories of exposed cameras - can surface live camera feeds. The speakers were emphatic that this requires proper authorisation and raises real ethical and legal concerns.

Social Media Analysis: Turning an Email Into a Person

Most dynamic information about a person flows through social media, and it often starts from a single email address. Breach-lookup platforms like Have I Been Pwned and DeHashed do more than tell you whether an account was in a breach - the pattern of breached sites paints a behavioural picture (food-delivery sites suggest a foodie; pet sites suggest a pet owner), and some breaches expose usernames, locations, and even plaintext passwords.

From a username, tools like Sherlock and What's My Name enumerate where else that handle appears across the web. None of it is guaranteed accurate, but each result is a pointer - and pointers, cross-referenced, become a map. The speakers described pivoting from breach data to Instagram, X, Facebook, and TikTok, then using people's own habits against them: photos that reveal who they associate with, Snapchat posts that reveal daily locations, and - remarkably often - pictures of boarding passes and vehicles with visible registration plates.

Vehicle OSINT: License Plates and the VIN

A vehicle registration mark (a number plate) is a starting thread. In India, RTO lookups can return an owner's name in plain text along with challan (traffic-ticket) history - which itself builds a behavioural profile (for example, a record of driving under intoxication).

The deeper identifier is the VIN - a 17-character alphanumeric "fingerprint" for a vehicle. VIN decoders return the make, model, year, and engine, but more usefully the recall history, complaints, sales records, and salvage records - a whole ownership and incident history. (The speakers pointed to the "Kia Boys" incident, where a documented security flaw in certain Kia and Hyundai cars became a TikTok trend, as an example of recall data mattering.) Cross-referencing a VIN lookup with the earlier social-media work, the speakers were able to tie a vehicle back to the same person - surfacing phone numbers, a primary residence, and a second email address.

Maritime OSINT: Tracking Ships With AIS and VSAT

Ships identify themselves using AIS (Automatic Identification System), a short-range transponder system operating around 162 MHz that lets vessels announce themselves to others nearby. Public AIS maps expose both static data (IMO number, MMSI, vessel name and type) and the dynamic data investigators care about - position, heading, and speed - which can even help spot unidentified vessels and illicit activity. AIS has a limited range (roughly 20 to 350 nautical miles), so beyond coastal waters, ships rely on VSAT (Very Small Aperture Terminal) satellite systems. The speakers showed that VSAT consoles - discoverable through internet scanning engines - often expose GNSS position and status reports with no authentication at all, plus static reports going back days, weeks, and months.

Aircraft OSINT: ADS-B and the Limits of Redaction

Aircraft continuously broadcast their position using ADS-B (Automatic Dependent Surveillance-Broadcast) on 978 and 1090 MHz. Consumer sites like AirNav Radar, Flightradar24, and FlightAware crowdsource this from volunteer receivers - but they redact sensitive flights (the speakers cited the well-known case of a certain billionaire's jet being hidden) and gate advanced features behind subscriptions.

The interesting alternatives:

• ADSB Hub aggregates raw, unredacted receiver data from around the world - the data "in its rawest and purest form" - useful when consumer sites have no coverage in a given area.
• ADS-B Exchange is similar to consumer trackers but famously does not redact, making it valuable for tracking government aircraft, choppers, and drones during geopolitical investigations. Its squawk-code filters can hide all civilian traffic and leave only state-operated aircraft on the map.

Signals OSINT: Listening to the World With Web SDR

The final segment moved from tracking to listening. SDR (Software-Defined Radio) replaces conventional radio hardware with software, and Web SDR puts internet-connected receivers in a browser. The speakers told the story of finding, via a Reddit forum, a university web SDR whose antenna was positioned to pick up live radio communications from a conflict zone - something only a few hundred people worldwide could hear.

Beyond eavesdropping, web SDRs can decode signals. Because ADS-B receivers are sparse, an aircraft passing through an uncovered area may appear on no website at all - but tuning the right web SDR to the right frequency and decoding it (with open-source software like OpenWebRX) can recover data that exists nowhere else online. The same approach decodes marine AIS, FT8, pager traffic (still used in healthcare and emergency services), and SSTV image transmissions.

Frequently Asked Questions

Is OSINT tracking legal?

Collecting genuinely public information is generally lawful, but the moment you access a camera you are not authorised to view, or use the data to stalk or harm someone, you cross a legal and ethical line. The speakers repeatedly stressed authorisation and ethics, and framed the entire talk as educational - "the misuse of any information provided herein shall be the sole liability of the abuser".

How can I reduce my own OSINT footprint?

Assume anything you post is permanent and public. Do not share photos of boarding passes, number plates, or documents; strip location metadata and avoid real-time location posts; use unique usernames and emails per service so a single breach cannot link your accounts; and check breach-lookup sites to see what is already exposed about you.

Do I need special hardware to do any of this?

Mostly no - that is the point. AIS maps, ADS-B trackers, breach-lookup sites, and web SDRs all run in a browser. Dedicated hardware (an antenna and an SDR receiver) only becomes necessary when you want to capture signals in a location no existing public receiver covers.

Summary

OSINT tracking works because the modern world is loud: ships, planes, radios, and people all broadcast far more than they realise, and the receivers are a browser tab away. Sagar and Shubham showed how an investigator pivots from an email to a username, a username to a vehicle, a vehicle to a home address - and how AIS, ADS-B, and web SDR extend that same pattern-finding to the physical world. Their closing note is the one to keep: with great power comes great responsibility. Keep your ethical standards high, respect privacy and authorisation, and use these techniques to understand - and shrink - your own exposure.

About the Speakers

Sagar Tiwari is an independent cybersecurity researcher, OSINT investigator, and cyber journalist who has published over 50 articles and spoken at conferences including SANS-affiliated summits and DEF CON DC91. He leads an Indian CTF team and goes by the alias "Ellim87". Shubham Kumar is a Senior Information Security Analyst at TransUnion, a cybersecurity evangelist, and an OSINT enthusiast who has co-presented on the subject at multiple conferences. They delivered this talk at BSides Mumbai 2024.

Watch the Full Talk

Want every tool, map, and case study in full? Watch the complete BSides Mumbai 2024 session below.