Unmasking Evil: How OSINT Exposed a Dark Web Monster

What begins as a casual research project for an unrelated blog post turns into a life-saving investigation. While exploring a dark web forum, I came across a disturbing post from someone asking for advice on kidnapping people and selling their organs. In this talk, I’ll walk through how an ordinary OSINT inquiry escalated into identifying a real person operating under an anonymous identity, and how that information was passed on and ultimately led to an arrest in another country. Attendees will follow the full investigation step-by-step as I demonstrate the basic tools, logic, and thinking behind it. I’ll show how a single ProtonMail address became the key pivot point, how I linked it to a social media account, and how I used Python to generate and test possible email variations until I found the right one. I’ll also cover how that discovery opened up more clues, including personal emails, home addresses, social media accounts, and connections to others. Along the way, I’ll share what I learned from doing this as a student with no formal training, sitting in my university dorm late one night. I’ll be honest about what I wish I’d done differently knowing what I know now, such as how I should have captured and documented more data before the entire forum was taken offline shortly after. This talk aims to show that impactful OSINT work doesn’t always come from big teams or official roles, but from individuals who follow their curiosity and instincts. Key Takeaways: Practical techniques for tracing identities across the dark web, email, and social media. Using simple Python scripts to generate leads and automate small but time-consuming steps. Reflections on what I wish I’d done differently and lessons learned about evidence capture and investigation workflows. How networking and curiosity can open doors to tools and opportunities. A reminder that anyone can make a difference through OSINT, no matter where they start.