OSINT

FOR ANALYZING
FAKE NEWS

A GUIDE FOR
JOURNALISTS, INVESTIGATORS, AND LAW ENFORCEMENT

ISBN: 978-973-0-37583-1
 PROGRAM TITLE:
Strengthen Cybersecurity Education and Research
for Preventing Cybercrime

PURPOSE OF THE PROGRAM:

Strengthening cybersecurity education and promoting
cybersecurity research for preventing cybercrime

U.S. Embassy in Romania

Romanian Association for Information Security Assurance

A project developed by the Romanian Association for Information Security Assurance (RAISA).
This project was funded in part by a grant from the United States Department of State.
The opinions, findings, and conclusions stated herein are those of the author[s]
and do not necessarily reflect those of the United States Department of State.

eBook: OSINT for Analyzing Fake News

Authors: Ismael ALVAREZ, Marcin GOLIZDA, Istvan HEREDI, Joseph JONES, Gianluigi ME,
Ioan-Cosmin MIHAI, Peter POTS, Ionuț STOICA, Cătălin ZETU

Version: 1.1

Website: https://www.cyberlearning.ro/osint-for-analyzing-fake-news

ISBN: 978-973-0-37583-1

DOI: 10.19107/OSINT-4-FAKE-NEWS
 TABLE OF CONTENTS

ABOUT THIS GUIDE ................................................................................................. 4

QUICK CHECKLIST .................................................................................................... 5

PREPARING THE ENVIRONMENT ............................................................................. 6

BROWSER EXTENSIONS ........................................................................................... 7

ADVANCED SEARCHING........................................................................................... 8

WEB-BASED TOOLS ................................................................................................. 9

EMAIL-BASED TOOLS ............................................................................................. 10

SOCMINT TOOLS ................................................................................................... 11

IMAGE ANALYSIS TOOLS........................................................................................ 12

VIDEO ANALYSIS TOOLS ........................................................................................ 13

AUTHORS .............................................................................................................. 14

Note: The tools presented here are open source, so they need constant updates to work correctly. If
you observe that some tools are not working well, please get in touch with us to find a substitute.

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 3
ABOUT THIS GUIDE

The way in which disinformation manifests itself in the highly globalized, technologized, and hyper-
connected public spaces of liberal democracies makes it a phenomenon for which hardly any good
historical precedent can be found, in spite of some continuities with previous efforts towards
influencing decision-makers and public opinion. It takes place under conditions of information over-
abundance, not information scarcity; it has the technological possibilities to go straight to the people
and for people to spread it directly, most of the time without being aware; it changes journalism,
demanding new practices and skills in terms of adaptation to the attention industries driven by social
media.
Contemporary disinformation, which is sometimes designated with the popular, even fashionable
term “fake news”, is a two-fold phenomenon. It interferes with content (“old propaganda/
disinformation) but with new technological possibilities for text, photo, or video manipulation, and it
interferes with content amplification, manipulating the social component of social media; the latter
can be done by bots, trolls factories, clickbait factories, fake followers, automated journalism, data-
driven targeted advertising, increasingly driven by machine learning and artificial intelligence.
Understanding disinformation as interfering both with content (“fake content” and content
impersonating legitimate information sources) and with its amplification (“fake” circulation and
amplification) becomes an essential skill, both at a personal and institutional level.
In this context, a structured, clear, and concise guide such as “OSINT for analyzing fake news” is very
useful for specialists navigating and working in today’s information ecosystem, be they journalists,
investigators, law enforcement, researchers, educators, or even regular citizens. It marks an
important step that responds to an increasing demand to tackle various types of disinformation, from
fabricated and manipulated content to fake news websites whose content becomes viral on social
media. It encompasses key recommendations regarding content verification, including verification of
content circulation, from web-based tools, such as URL scanners, browser extensions, blacklist
checkers, or domain analysis, to social media intelligence tools for Facebook, TikTok, YouTube, or
image and video analysis tools. Such initiatives, which correctly place the core of contemporary
disinformation in the digital environment, serve to better understand the interplay between social
media and disinformation, the way in which disinformation originating from social media, if left
unchecked, penetrates mainstream media and then the entire public conversation.
I hope that this guide will empower the specialists and institutions dealing with one of the most
valuable assets of liberal societies – information, whose accuracy and resilience influence public trust,
the quality of public conversation, and the quality of democracy overall. Protecting these public
assets by tackling disinformation should be conceived as an ongoing battle for the integrity of the
information and communication infrastructure, which, as the current international turmoil indicates,
needs to be treated just as any other critical infrastructure.

Alina BÂRGĂOANU, Ph.D., an expert in tackling disinformation,

Member of the Advisory Council of the European Digital Media Observatory

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 4
QUICK CHECKLIST

CHECK THE CONTENT

Is the article content credible? Are the presented facts and statistics possible?

CHECK THE DATE

Is the date accurate? Is the article correlated with the date?

CHECK THE SOURCE

Is the source reliable? Analyze the URL, website, or social media account.

CHECK THE AUTHOR

Is the author known in the field? Does the author have a track record?

CHECK THE MEDIA

Analyze the pictures or videos from the article so as not to be fake.

CHECK THE REFERENCES

Can you verify the references presented in the article? Are they reliable?

CHECK YOUR BIASES

Consider if your beliefs could affect your judgment.

ASK THE EXPERTS

Find experts in the specific field and ask their opinion.

THINK BEFORE SHARING

Examine the article before sharing it. Search on verified fact-checking websites.

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 5
PREPARING THE ENVIRONMENT

VIRTUAL MACHINE
A virtual machine is an emulated environment that functions as a virtual computer
system with its processor, memory, and storage. It can be easily installed on your
computer to have a virtual environment separated from the real one.

COMPUTER CLEANERS
A computer cleaner will protect your privacy by erasing your browser search history
and cookies. It will help your internet browsing to stay confidential and your identity
to remain anonymous.

VIRTUAL PRIVATE NETWORKS

A virtual private network is a service that encrypts your internet traffic on unsecured
networks to protect your online identity, hide your IP address, and shield your online
activity from third parties.

PROXY SERVERS
A proxy server is a system that provides a gateway between users and the internet.
The server goes between end-users and the web pages they visit online, hiding users’
IP addresses.

INTERNET BROWSERS
Choose your browser to have a fast and secure experience on the internet. Google
Chrome, Mozilla Firefox, Microsoft Edge, Safari, and Opera are the most used
browsers.

BROWSER EXTENSIONS
The extensions add features and functions to a browser. You can choose extensions
that will improve your computer safety and privacy. There are many extensions made
for Google Chrome and Mozilla Firefox browsers.

CYBERSECURITY SOLUTIONS
Cybersecurity solutions are technological tools and services that help protect your
computer against cyber-attacks and infection with malware. The most popular
solutions for end-users are antiviruses and firewalls.

TEST YOUR CONNECTION

Test your connection to be sure you don’t leak important information from your
computer. Check the information that can be seen and collected about you using a
service like https://ipleak.net/ or https://amiunique.org/.

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 6
BROWSER EXTENSIONS

UBLOCK ORIGIN or SCRIPTSAFE

These extensions block undesired scripts from loading by default.

HTTPS EVERYWHERE
It enables secure web protocol everywhere.

LOCATION GUARD
It hides your geographic location.

CANVAS DEFENDER
It adds random noise to prevent tracking.

FAKE NEWS DEBUNKER BY INVID & WEVERIFY

It helps in fact-checking and debunking tasks on social networks.

IMAGE DOWNLOADER
It downloads many images at once.

SINGLEFILE
It helps you to save a complete page as a single file.

USER-AGENT SWITCHER
It emulates various browsers and devices.

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 7
ADVANCED SEARCHING

SEARCH ENGINES
Choose your search engine according to your preferences. The most used search
engines are Google, Bing, Yahoo!, DuckDuckGo, and Carrot2.

SEARCH OPERATORS
Search operators or dorks are commands you can use in most search engines to refine
the results. This is a list of the most used search operators:

Operator Description
“ The results will only include the same words in the same order as
the ones inside the quotes.
Example: “fake news”
* Use the asterisk mark (*) to replace the missing words or letters.
Example: “fake news is * information”
- Use the minus sign (-) followed by the word you want to exclude.
Example: “fake news” -propaganda
site: Get results from certain sites or domains.
Example: “fake news” site:enisa.europa.eu
link: Find pages that link to a certain page.
Example: “fake news” link:youtube.com
filetype: Search for a specific file type.
Example: “fake news” filetype:pdf
intitle: Find pages with specific words in the title.
Example: intitle:“fake news”
inurl: Find pages with specific words in the URL.
Example: intitle:“fake news”
intext: Find pages with specific words on the page.
Example: intitle:“fake news”

TRANSLATION SERVICES
Many services can translate a text from one language to another one:
• Google: https://translate.google.com
• Bing: https://www.bing.com/translator
• DeepL: https://www.deepl.com/translator

For simultaneous searches in two languages: https://2lingual.com

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 8
WEB-BASED TOOLS

DOMAIN ANALYSIS
Discover information about domains
• https://whois.domaintools.com
• https://centralops.net/co

URL SCANNER
Discover information about websites’ URL
• https://urlscan.io
• https://www.urlvoid.com

DNS LOOKUP
Discover information about domain name systems (DNS)
• https://dnschecker.org/all-dns-records-of-domain.php
• https://viewdns.info

BLACKLIST CHECK
Check if a domain is saved in a spam database
• https://www.blacklistalert.org
• https://mxtoolbox.com/blacklists.aspx

IMAGE EXTRACTOR
Extract images from websites
• https://extract.pics
• https://download-all-images.mobilefirst.me (extension)

SIMILARITIES DETECTION
Find other websites with similar content
• https://www.copyscape.com
• https://www.similarweb.com

WEBSITE ARCHIVE
Analyze the history of websites
• https://archive.org/web
• https://archive.ph

MALWARE ANALYSIS
Analyze websites for malware infection
• https://www.virustotal.com/gui/home/url
• https://sitecheck.sucuri.net

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 9
EMAIL-BASED TOOLS

EMAIL VERIFICATION
Check whether an email address exists
• https://tools.emailhippo.com
• https://centralops.net/co

EMAIL REPUTATION
Analyze email addresses' reputation
• https://emailrep.io
• easydmarc.com/tools/ip-domain-reputation-check

BLACKLIST CHECK
Check if an email address is saved in a spam database
• https://mxtoolbox.com/blacklists.aspx
• https://dnschecker.org/ip-blacklist-checker.php

GET EMAIL HEADERS

Learn how to access the email headers
https://mxtoolbox.com/Public/Content/EmailHeaders

EMAIL HEADER ANALYSIS

Analyze email headers to discover information about the sender
• https://toolbox.googleapps.com/apps/messageheader
• https://www.iptrackeronline.com/email-header-analysis.php

IP ANALYSIS
Discover information about IP addresses
• https://www.ipaddress.com/reverse-ip-lookup
• https://securitytrails.com (subscription required)

ATTACHMENT TYPE
Analyze email attachments’ type
• https://www.checkfiletype.com
• https://filext.com/file-extension/CHECK

MALWARE ANALYSIS
Analyze files for malware infection
• https://www.virustotal.com/gui/home/upload
• https://www.hybrid-analysis.com

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 10
SOCMINT TOOLS

Top Social Networks Search: https://www.social-searcher.com/google-social-search

TWITTER
• Analytics tools: https://socialbearing.com and https://tweetbeaver.com
• Visualizing the spread of information: https://hoaxy.osome.iu.edu
• Real-time tracking: https://tweetdeck.twitter.com
• Video downloader: https://www.downloadtwittervideo.com

FACEBOOK
• Search: https://www.sowsearch.info
• Tools: https://inteltechniques.com/tools/Facebook.html
• Video downloader: https://fdown.net

LINKEDIN
• Search profiles: https://recruitin.net
• Analytics tools: https://www.inlytics.io
• Video downloader: https://www.expertsphp.com/linkedin-video-downloader

INSTAGRAM
• Profile analyzer: https://inflact.com/tools/profile-analyzer
• Analytics tools: https://analisa.io (subscription required)
• Video downloader: https://instadp.io

TIKTOK
• Search: https://www.osintcombine.com/tiktok-quick-search
• Analytics tools: https://socialblade.com/tiktok
• Video downloader: https://ttdown.org

YOUTUBE
• Metadata tools: https://mattw.io/youtube-metadata
• Channels analytics: https://studio.youtube.com
• Video downloader: https://snapsave.io/en2

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 11
IMAGE ANALYSIS TOOLS

REVERSE SEARCHES
Perform reverse images search
• https://tineye.com
• https://www.google.com/imghp

IMAGE ANALYSIS
Perform images analysis
• https://www.aperisolve.com
• snapwonders.com/upload/analyse-photo-or-image

IMAGE FORENSICS
Perform images forensics
• https://29a.ch/photo-forensics
• https://fotoforensics.com

METADATA VIEWER
Analyze images extra or even hidden data
• https://exifdata.com
• https://jimpl.com

IMAGE-TO-TEXT CONVERTER
Convert images to text
• https://www.onlineocr.net
• https://ocr.space/copyfish (extension)

FACE RECOGNITION
Perform face recognition search
• https://pimeyes.com/en
• https://betaface.com/demo.html

STEGANOGRAPHY DETECTION
Perform stenography detection on images
https://mcafee.com/enterprise/en-us/downloads/free-tools/steganography.html

GEOLOCATION ESTIMATION
Estimate images geolocation
https://labs.tib.eu/geoestimation

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 12
VIDEO ANALYSIS TOOLS

REVERSE SEARCHES
Perform reverse videos search
• https://berify.com
• https://www.google.com/imghp

VIDEO ANALYSIS
Perform videos analysis
• http://lvcdn.net/gop
• https://snapwonders.com/upload/analyse-video

METADATA VIEWER
Analyze videos extra or even hidden data
• https://www.metadata2go.com
• https://www.flexclip.com/tools/metadata-video

VIDEO DOWNLOADER
Download videos locally
• https://catchvideo.net
• https://smallseotools.com/online-video-downloader

VERIFICATION TOOLS
Perform videos and images verifications
https://www.invid-project.eu/tools-and-services/invid-verification-plugin (extension)

VIDEO EDITOR
Edit video files
• https://clideo.com
• https://www.kapwing.com/studio/editor

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 13
AUTHORS

Ismael ÁLVAREZ is a cybercrime investigator with more than 17 years of experience. He is also a
trainer and expert who supports different law enforcement agencies and organizations regarding
open-source investigations. Currently, he is working and developing new techniques on web3
technologies such as decentralized platforms, blockchain-based technologies, and Metaverses.
Marcin GOLIZDA is a professor at the AGH University Cracow and a former head of the Cybercrime
Department of the Polish National Police HQ. He was dedicated to the technical support units and
was responsible for incorporating new technologies for organized crime and cybercrimes fight. He
was a National Contact Point of the European Network of Law Enforcement Technology Services.
István HERÉDI is a cyber security expert, cyber investigator, and trainer with an experience of more
than ten years in cybercrime, cybersecurity, and open-source intelligence. He is a lead cyber
investigator at the Hungarian National Bureau of Investigation Cybercrime Department and the
EMPACT representative for Hungary in the Cyber Attacks OAP.
Joseph JONES is the founder of OS2INT and the Director of Training and Capability Development for
Paliscope. A former British Military and Law Enforcement Intelligence officer, Joseph has more than
15 years of intelligence-gathering and investigative experience. He is also an external expert for
European Union Agencies: CEPOL, FRONTEX, ENISA, and Expertise France.
Gianluigi ME, Ph.D., is OF-4 of the Carabinieri Corps LEA at the IT Department at HQs. Since 2008 he
has been an Adjunct Professor at the Faculty of Economics and Faculty of Management and Computer
Science at LUISS University. Since 2016 he has been an external trainer for CEPOL, with experience in
cyberterrorism in the MENA region. He is the author of over 60 publications.
Ioan-Cosmin MIHAI, Ph.D., is a researcher, trainer, and speaker, with an experience of more than 15
years in cybercrime, cybersecurity, and open-source intelligence. He is a training officer at the EU
Agency for Law Enforcement Training (CEPOL), an external expert at the EU Agency for Cybersecurity
(ENISA), and vice-president of the Romanian Association for Information Security Assurance (RAISA).
Peter POTS is an OSINT Investigator/Analyst at the Security Directorate of the European Commission.
He has been working as an OSINT specialist since 2015. He is specialized in security investigations and
gathering information from open sources for threat analysis. He worked for ten years as an IT expert
in the private sector and more than twenty years in LEA doing criminal investigations.
Ionuț STOICA is leading the Cybercrime Academy Sector within the European Union Agency for Law
Enforcement Training (CEPOL). He has more than 16 years of experience in cybercrime investigations
and training and is currently involved in various capacity-building programs on cybercrime and
electronic evidence.
Cătălin ZETU is leading the Cyber-Attacks Office, part of the Romanian Central Cybercrime Unit, with
broad responsibilities from investigations to intelligence and strategy. He is developing a strong
partnership with private partners to bust the overall capacity of the unit. He is a cybercrime
investigator that worked on or supervised high-profile cases with international ramifications.

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 14
 The Romanian Association for Information Security Assurance (RAISA) is a professional, non-
governmental, non-partisan political, nonprofit, and public benefit association founded in 2012. It
aims to promote and support information security activities in compliance with applicable laws and
to create a community for exchanging knowledge between experts.
Website: https://www.raisa.org

REPRESENTATIVE PROJECTS

CyberCon Romania Conference focuses on cybersecurity's latest trends, challenges, and

future strategic directions. It brings relevant experts from public institutions, private companies,
universities, and NGOs to raise awareness, strengthen the cybersecurity culture, and share best
practices in fighting cybercrime.
Website: https://www.cybercon.ro

The International Conference on Cybersecurity and Cybercrime (IC3) aims to encourage the
exchange of ideas about the evolution of cyberspace, information security challenges, and new facets
of cybercrime. The event started in 2014 as an initiative to provide the appropriate framework for
students to present their research in this field.
Website: https://proceedings.cybercon.ro

The International Journal of Information Security and Cybercrime (IJISC) is a scientific peer-
reviewed journal founded in 2012 and indexed in international databases. The scientific journal aims
to bring together the latest research and development in information security and the latest methods
to prevent and combat cybercrime.
Website: https://www.ijisc.com

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 15
 OSINT FOR ANALYZING FAKE NEWS
GUIDE

OSINT for Analyzing Fake News

ISBN: 978-973-0-37583-1, DOI: 10.19107/OSINT-4-FAKE-NEWS 16