# OSINT: handles, threads, and open-web search 2026-09-02 > Three public JSON steps: handle resolve, comment thread, Google site: search. Public accounts only. - Index: https://fetcher.sh/blog.md - This page (HTML): https://fetcher.sh/blog/osint-handle-thread-open-web ![A terminal window full of command output](https://images.unsplash.com/photo-1504639725590-34d0984388bd?auto=format&fit=crop&w=1600&q=80) Photo by Markus Spiske on [Unsplash](https://unsplash.com/?utm_source=fetcher_sh&utm_medium=referral). OSINT, here, is three public steps: resolve a handle to a stable id, reconstruct a thread, search the open web with Google `site:`. Journalism and investigation on public accounts. Not doxxing, not private profiles, not skip-tracing databases, not people-search vendors. Public only. The steps compose notes that already exist. This one names the job so a query for OSINT still retrieves a workflow instead of a single host. 1. [Handle resolution](/blog/resolving-a-social-handle-to-a-stable-id) on X, IG, TikTok, YouTube, or Reddit. 2. [Threads](/blog/comment-threads-youtube-instagram-tiktok-reddit-x) on those hosts. 3. SERP with `site:` on [google.fetcher.sh](https://google.fetcher.sh). [Market research](/blog/market-research-reddit-app-reviews-youtube-comments) is a different job on similar objects — product questions, not investigation. Keep the public-only pin in the opening of any follow-up. We do not sell private account data. ## Three public GETs Resolve on twitter.fetcher.sh `/api/handle/{handle}`, pull replies, then `https://google.fetcher.sh/api/search?query=site:example.com+name`. That is the skeleton. In practice you store the id on day one because handles rot. You pull the thread because a screenshot of the parent is not the conversation. You run `site:` because the interesting trail is often a personal site, a GitHub, a PDF, not another tweet. Do not skip resolve and paste a handle into a path that wants a numeric id. Do not treat a private account 404 as a puzzle to brute-force. If it is not public, it is not in this catalog. People-search vendors and skip-tracing databases are out. If a briefing asks for a home address, you are in the wrong product and the wrong profession for this API. ## Public is a constraint, not a slogan OSINT as a word gets used for a lot of sins. Here it is deliberately small. Public handle, public thread, public web. Journalism, incident response, academic reconstruction of a public fight. Not stalking. Not “find this person’s employer via a leak.” If your workflow needs a non-public surface, stop using these hosts for that part. Official platform tools, legal process, and actual investigators exist. JSON from a priced GET is not a substitute for any of that. Market research will look similar in a network tab: Reddit trees, YouTube comments. The frame is different. “What do users hate about habit trackers” is not OSINT. “What did this public account say in January, and what else on the open web matches” is. ## A case: a reporter reconstructing a public fight A reporter has a tweet URL, a handle, and a rumor that the same person wrote a long GitHub issue. They resolve the handle, fetch the tweet and replies, then Google `site:github.com` plus the name as it appears on the public profile. They do not ask us for private emails. They do not pull followers to build a contact list for harassment. They reconstruct the public timeline so quotes have context. If a tweet is gone, the envelope says so. If GitHub has nothing, they do not invent a link. [X operators](/blog/x-search-operators-from-since-until) help when the window matters: `from:… since:… until:…`. The OSINT job is the sequence, not the operator language. ## A case: an incident-response intern with a screenshot Someone drops a screenshot of a TikTok comment into the incident channel. The intern takes the public post id, pulls comments and nested replies, resolves the username to an id, and runs a Search pass on a domain the comment named. They write a note: public objects only, ids stored, no private lookup. The screenshot is no longer the evidence; the JSON is. If the account is private, they stop. They do not open a people-search site “just to be sure.” A third step that is easy to skip: `site:` the domain the thread named, plus `filetype:pdf` if the interesting artifact is a memo. OSINT that stops at social will miss the PDF. OSINT that only Googles will miss the thread. The job is the sequence. Write the constraint at the top of the notes file: public accounts, no skip-tracing, no home addresses. If a manager asks for the third, that is not a fetcher.sh feature request. Handle, thread, `site:` — in that order — is the ritual worth putting in a checklist. Skipping resolve is how timeline paths 400. Skipping the thread is how a screenshot becomes the record. Skipping Search is how you miss the PDF. Doing extra people-search is how you leave the catalog and the law. Market research will look similar in the network tab. Write “investigation” or “product” at the top of the file so you do not mix frames. ## Public accounts only Resolve, then thread, then `site:` search. Journalism and investigation on what anyone could already see, structured. Docs on the hosts you actually call. Payment is 402 or a key. If the next step would not be legal to do in a browser as a stranger, do not do it here either.