# 5-Prompt Chain: Internet Verification and OSINT Investigations > A step-by-step 5-prompt OSINT methodology for online fact-checking and verification: scoping, email audits, username pivots, source corroboration, and report synthesis. Open Source Intelligence (OSINT) and digital fact-checking are disciplined, structured methodologies rather than haphazard web browsing. The most common pitfall for researchers is launching an investigation without a defined scope or accepting unverified claims and coincidental username matches as established fact. This guide delivers an operational framework built around **5 sequential prompt templates** guiding the analyst through the complete intelligence lifecycle: from task definition (**Scope**) and asset collection (**Collect**) to lead expansion (**Pivot**), rigorous evidence testing (**Verify**), and structured reporting (**Document**). --- ## 1. Architecture and Principles of the OSINT Prompt Chain Effective interaction with large language models during digital investigations relies on the principle of prompt chaining. ### 1.1. How Multi-Stage Prompt Chaining Operates Rather than attempting to extract comprehensive conclusions from a single monolithic query, the workflow proceeds incrementally: - **Downstream prompts consume upstream findings:** Insights discovered during email analysis provide candidate usernames, which subsequently feed into fact-checking queries. - **Enforcing verification over speculation:** Prompts are engineered to demand structured audit checklists and empirical tests rather than ungrounded AI predictions. - **Critical evaluation of every hypothesis:** The model's synthesis serves as a working lead that must be corroborated against primary source evidence. ### 1.2. The Five Phases of the Investigation Cycle Professional investigations cycle through five closed-loop phases: ```mermaid flowchart LR Scope["1. Scope: Plan & Boundaries"] --> Collect["2. Collect: Data Gathering (Email)"] Collect --> Pivot["3. Pivot: Handle Correlation"] Pivot --> Verify["4. Verify: Primary Sources"] Verify --> Document["5. Document: Report & Gaps"] ``` Each prompt below corresponds to one specific phase of this cycle, preserving context and preventing cognitive fatigue. --- ## 2. Ethical Standards, Legal Boundaries, and Digital Hygiene Open-source research must operate within clear legal and ethical boundaries. ### 2.1. Legal Frameworks and Permissible Public Sources (GDPR, Due Diligence) The prompt chains in this guide are intended exclusively for legitimate professional disciplines: - Corporate counterparty evaluation (Due Diligence); - Investigative journalism and public interest research; - Threat intelligence and organizational digital attack surface audits; - Countering disinformation, deepfakes, and synthetic narratives. Only gather publicly accessible data through legal channels without circumventing access controls, violating data protection regulations (such as GDPR), or compromising authentication mechanisms. ### 2.2. Doxxing Prevention and Investigator Operational Security > [!CAUTION] > Utilizing OSINT techniques for doxxing, harassment, unlawful stalking, or unauthorized surveillance of private individuals is strictly prohibited. If an inquiry infringes upon legitimate personal privacy rights, terminate the investigation immediately. --- ## 3. Prompt 1 (Scope): Structuring the Strategic Investigation Plan The Scoping phase establishes the operational foundation. A vague initial objective invariably produces superficial, noisy results. ### 3.1. Objective Calibration and Entity Mapping Logic This prompt instructs the language model to act as a senior intelligence analyst, decomposing the target problem into discrete entity types (individuals, domains, infrastructure, corporate vehicles), identifying target public records, and documenting operational assumptions. ### 3.2. Prompt Template for Objective Scoping and Source Allocation ```text You are an OSINT analyst. My objective is: [state goal in one sentence]. I am authorised to use public sources only. Produce a structured plan: 1. Key questions to answer with verifiable evidence; 2. The entity types involved (people, domains, emails, infrastructure); 3. The public source categories to check for each entity; 4. The sequential order of operations (priority ranking); 5. The critical risks, cognitive biases, and assumptions to watch; 6. End with the single highest-value first step. ``` --- ## 4. Prompt 2 (Collect): Email Verification and Digital Footprint Analysis Email addresses represent the most common entry vector in digital investigations, bridging individual identities with organizations and network domains. ### 4.1. Structural Analysis and Exposure Vectors (Breaches, Registrations) The critical constraint here is demanding a structured checklist of empirical tests rather than AI-generated biographies. The prompt explores structural characteristics, breach leaks, paste sites, and public registry footprints. ### 4.2. Prompt Template for Email Footprint Auditing ```text For the email [insert email], outline a public-source investigation: 1. What the local-part and domain suggest (hosting infrastructure, corporate records, MX / SPF records); 2. Where this address may be exposed (public breach databases, paste sites, developer forums, public directory listings); 3. Categories of online services and platforms this email pattern might typically register with; 4. 3 concrete pivots to discover associated handles, accounts, or verified identities. Constraint: List verifiable checks and methods, not speculative guesses. ``` --- ## 5. Prompt 3 (Pivot): Username Search and Cross-Platform Validation Usernames are probabilistic hypotheses, not definitive proof of identity. The same alias on separate platforms frequently belongs to unrelated individuals. ### 5.1. Differentiating Authentic Matches from Handle Coincidences This stage establishes corroboration criteria. The model outlines cross-platform signal verification: comparing avatar imagery, profile bios, writing stylometrics, activity timestamps, and cryptographic public keys. ### 5.2. Prompt Template for Cross-Platform Identity Verification ```text For the username [insert username]: 1. List the digital platforms and communities most worth auditing first; 2. Define explicit criteria to differentiate an authentic single-user match from a coincidental handle overlap; 3. Identify cross-platform signals (avatars, bio descriptions, stylometric patterns, timezone timestamps, linked portfolio links) that confirm the same entity controls both profiles. ``` --- ## 6. Prompt 4 (Verify): Fact-Checking and Primary Source Corroboration Rigorous verification distinguishes legitimate intelligence work from confirmation bias. A single media citation constitutes a lead, never an established fact. ### 6.1. Falsification Methodology and Red Flags of Fabrication This prompt enforces deductive falsification: what must be true for the claim to stand; which primary government registries or historical archives can disprove it; and what visual or narrative manipulation red flags are present. ### 6.2. Prompt Template for Claim Verification and Confidence Scoring ```text Verify this claim using public sources: [insert claim]. Structure the analytical assessment as follows: 1. Deconstruct what conditions would have to be true for this claim to hold; 2. Identify primary authoritative sources (official registers, raw video metadata, archived announcements) that could confirm or refute each element; 3. Document red flags indicating digital fabrication, narrative manipulation, or out-of-context clipping; 4. Conclude with a formal Confidence Rating (High / Medium / Low / Uncorroborated) accompanied by analytical reasoning. ``` --- ## 7. Prompt 5 (Document): Compiling the Intelligence Report and Identifying Gaps The final phase synthesizes disconnected research notes into an intelligence brief. The credibility of the brief is proven by transparently identifying what remains unknown. ### 7.1. Structural Standards of Professional OSINT Reports The "Gaps and Unknowns" section protects decision-makers from overconfidence. Strictly separating primary factual observations from analytical inferences prevents cognitive overreach. ### 7.2. Prompt Template for Findings, Timeline, and Gaps Documentation ```text Turn these raw findings into a clear, structured OSINT report: [paste raw notes]. Format the briefing using these standardized sections: 1. Executive Summary: Core findings synthesized in under 3 sentences; 2. Key Findings: Each documented claim accompanied by its primary source citation and Confidence Rating; 3. Chronological Timeline of events; 4. Gaps and Unknowns: Explicit documentation of unconfirmed assumptions and missing data points; 5. Recommended Next Steps for field verification. Constraint: Strictly separate verified claims from analytical inferences. ``` --- ## 8. Source Classification Matrix and Frequently Asked Questions (FAQ) ### 8.1. Public Source Classification Across Core Entity Types | Entity Category | Public Source Repositories | Core Verification Methodology | | :--- | :--- | :--- | | **Email Addresses** | Breach archives, PGP key servers, DNS records | Compromised credential checks, MX / SPF / DMARC verification | | **Usernames & Handles** | Social networks, Git repositories, technical forums | WhatsMyName directory audits, commit history metadata analysis | | **Domains & IP Addresses** | WHOIS registries, SSL/TLS transparency logs | Historical WHOIS records, certificate logs (crt.sh), passive DNS | | **Quotes & News Claims** | Government gazettes, regulatory portals, news archives | Wayback Machine historical snapshots, fact-checking registries | | **Imagery & Media Files** | EXIF metadata, satellite imagery, public feeds | Reverse image lookups, shadow and terrain geolocation alignment | ### 8.2. Frequently Asked Questions (FAQ) > [!NOTE] > **Can large language models autonomously query live internet databases?** > Unless specifically connected to browsing tools or live APIs, models operate solely within their pre-training snapshot. Use these prompts to structure your investigative methodology, while executing live queries through dedicated tools and browser engines. > [!TIP] > **How should I handle username overlaps for common names?** > Correlate secondary markers: account creation dates, platform-specific interests, identical avatar hashes (verified via reverse image searches), and localized linguistic patterns. > [!IMPORTANT] > **Why is single-source corroboration unacceptable in intelligence work?** > Any isolated claim can stem from digital artifacts, AI-generated deepfakes, or deliberate narrative deception. The standard OSINT benchmark demands corroboration across at least two independent primary records. > [!WARNING] > **Mitigating AI Hallucination Risks in Investigations** > Language models are prone to generating fictitious citations with high rhetorical confidence. Always demand direct source references and manually inspect the live underlying URLs or archive snapshots.