investigate-anything

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Investigate anything

调查任意目标

The front door. Everything downstream is faster than the thinking that should precede it, which is why most bad investigations are not collection failures — they are framing failures. You can run forty tools against a name and produce a confident dossier on the wrong person. The work here is deciding what question you are answering, what would count as an answer, and what would prove you wrong.

这是调查的入口。后续所有工作的速度都快于前置的思考环节——这也是大多数失败调查并非收集失误，而是框架设定失误的原因。你可能针对一个名字运行四十种工具，却产出一份关于错误人员的详实档案。此处的核心工作是确定你要解答的问题、什么才算答案，以及什么能证明你错了。

Core vocabulary

核心术语

Used across every skill in this repo, defined only here.

Selector — one identifiable data point: name, handle, email, phone, domain, IP, wallet, hash, plate, IMO, company number.
Pivot — turning one selector into new selectors (email → breach record → reused handle → forum profile → real name). An investigation is a chain of pivots. Every pivot is also a chance to jump onto a different person.

本仓库所有技能都会用到这些术语，仅在此处定义：

Selector ——一个可识别的数据点：姓名、账号、邮箱、电话、域名、IP、钱包地址、哈希值、车牌、IMO编号、公司注册号。
Pivot ——将一个Selector转化为新的Selector（邮箱→泄露记录→复用账号→论坛资料→真实姓名）。调查的本质就是一系列Pivot的链条。每一次Pivot都有可能转向另一个无关人员。

Step 1 — Authorized scope

步骤1——授权范围

Read ../../ETHICS.md, then write down five things:

Subject — the specific entity, distinguished from anyone with a similar name. Write the discriminators you will use ("the J. Okonkwo who is a director of company 09xxxxxx", not "J. Okonkwo").
Objective — see Step 2.
In bounds — selector types, sources, and whether interaction is allowed.
Out of bounds — the named things you will not do: logging into anything belonging to the subject, contacting them, family members, medical or religious data, and any selector unrelated to the objective.
Jurisdiction — whose law governs you, the subject, and the data. In the EU/UK, aggregating scattered public facts about a living person is processing personal data and needs a lawful basis and minimisation.

If you cannot state who authorized this and on what basis, stop. Not "proceed carefully" — stop. An unauthorized investigation cannot be fixed later by a good report.

Done when all five are written down and you can name the specific action that would put you out of bounds.

阅读../../ETHICS.md，然后写下以下五项内容：

调查主体——明确的实体，需与同名者区分开。写下你将使用的鉴别依据（例如「担任公司09xxxxxx董事的J. Okonkwo」，而非「J. Okonkwo」）。
调查目标——详见步骤2。
允许范围——可使用的Selector类型、数据源，以及是否允许与调查主体互动。
禁止范围——明确列出你不会做的事：登录调查主体的任何账号、联系他们或其家人、获取医疗或宗教数据，以及任何与调查目标无关的Selector。
管辖权限——约束你、调查主体及数据的所属法律。在欧盟/英国，汇总关于在世人员的零散公开事实属于处理个人数据，需具备合法依据并遵循最小化原则。

如果你无法说明谁授权了此次调查及授权依据，请立即停止。不是「谨慎推进」，而是直接停止。未经授权的调查无法通过后续的优质报告弥补。

完成标志：五项内容全部书面记录，且你能明确说出哪些具体行为会超出授权范围。

Step 2 — Frame an answerable question

步骤2——构建可解答的问题

"Find out about X" is not an objective; it has no stopping condition, so it terminates when you get bored or when you find something that feels like a result. Rewrite the request until it has a subject, a decision it feeds, and a condition that would settle it.

Vague	Answerable
Investigate this company	Does this supplier have an undisclosed owner subject to sanctions, and does it operate from the address on the invoice?
Who is this account	Is the operator of `@handle` the same person as the named ex-employee, or someone else?
Look into this domain	Is `example.com` operated by the same party as the phishing domain, on shared infrastructure?

Then write the negative: what finding would mean no. If nothing could, the question is unfalsifiable and you will confirm it whatever you see.

Done when the objective is one sentence, and you have written what a "no" answer would look like.

「调查X的相关情况」并非明确目标——它没有终止条件，只会在你感到厌倦或找到看似有结果的内容时结束。重新梳理请求，直到它包含调查主体、服务的决策事项，以及可判定结果的条件。

模糊表述	可解答问题
调查这家公司	该供应商是否存在未披露的受制裁所有者，且是否在发票上标注的地址运营？
这个账号是谁的	`@handle` 的操作者是否为指定的前员工，还是其他人？
调查这个域名	`example.com` 是否与钓鱼域名由同一主体运营，且使用共享基础设施？

然后写下反向假设：什么发现会得出「否」的结论。如果不存在这样的发现，说明问题无法被证伪，无论你看到什么都会倾向于确认预设结论。

完成标志：调查目标浓缩为一句话，且你已写下「否」答案的判定标准。

Step 3 — Write the collection plan before collecting

步骤3——收集前制定收集计划

Aimless pivoting feels productive because every pivot yields something. A collection plan is the list of questions, each mapped to the source most likely to settle it, ranked by cost and intrusiveness — so you notice when you're three hours into an interesting branch that answers nothing.

For each question: the indicator that would answer it, the source or skill that produces it, whether it is passive, and what you do if it comes back empty. Passive-first, always: exhaust archives, registries, and logs before anything that touches the subject. Plans are revised as you learn — the point is that deviations become visible.

Done when each objective question has a named source or skill and a first/fallback order.

无目的的Pivot看似高效，因为每次Pivot都会产出一些内容。收集计划是一份问题清单，每个问题对应最可能解答它的数据源，按成本和侵入性排序——这样你就能及时发现自己在一个有趣但无关的分支上浪费了三小时。

针对每个问题：列出能解答它的指标、提供该指标的数据源或技能、是否为被动收集，以及如果结果为空时的应对方案。始终优先采用被动收集：在任何接触调查主体的操作前，先穷尽档案、注册信息和日志。计划可随调查进展修订——关键是让偏离计划的行为变得可见。

完成标志：每个目标问题都对应指定的数据源或技能，且有优先/备选顺序。

Step 4 — Route by starting selector

步骤4——根据初始Selector选择工作流

Type the workflow skill's name.

You have	Run
A person's name or real identity	`find-anyone`
A company, brand, or invoice entity	`x-ray-a-company`
A domain, website, or IP	`recon-a-domain-passively`
A username or handle	`hunt-a-handle`
An email address	`what-an-email-reveals`
A phone number	`whose-number-is-this`
A photo or video to locate or verify	`where-was-this-taken`
A social profile you already attribute	`pattern-of-life-from-socials`

No clear starting point? Start with the selector that is both unique and indexed — email and domain beat name and handle, because names collide and handles are claimed by strangers.

Technique skills load themselves when you describe what you are doing. Before touching anything the subject controls, run

investigate-without-getting-made

. Keep the case in a graph from the first pivot:

graph-the-network

Done when the routed workflow has been run and its findings are recorded with sources.

输入工作流技能的名称：

你拥有的初始Selector	运行的技能
个人姓名或真实身份	`find-anyone`
公司、品牌或发票主体	`x-ray-a-company`
域名、网站或IP	`recon-a-domain-passively`
用户名或账号	`hunt-a-handle`
邮箱地址	`what-an-email-reveals`
电话号码	`whose-number-is-this`
需定位或验证的照片/视频	`where-was-this-taken`
已完成归因的社交账号	`pattern-of-life-from-socials`

没有明确的起始点？选择唯一且可被索引的Selector——邮箱和域名优于姓名和账号，因为姓名容易重复，账号可能被陌生人注册。

当你描述操作内容时，技术类技能会自动加载。在接触调查主体控制的任何内容前，先运行

investigate-without-getting-made

。从第一次Pivot开始，将案件信息存入图谱：

graph-the-network

。

完成标志：已运行选定的工作流，且其发现已附带数据源记录。

Step 5 — Grade sources as you collect, not afterwards

步骤5——收集时同步评级数据源

Use the Admiralty (NATO-style) scheme: a letter for the source and a number for the information, graded independently, on every item.

Letter A–F: the source's track record and access. A = reliable history, no doubt of authenticity; F = cannot be judged.
Number 1–6: whether the content is confirmed by other independent sources, and whether it is logical in itself. 1 = confirmed elsewhere; 6 = cannot be judged.

The independence matters: a corporate registry filing is B2, a well-run newspaper report of that filing is B2 at best, and an anonymous forum post repeating the newspaper is D3 — not new corroboration. Grade the source you actually touched, not the source it claims to have. Full grid, worked examples, and the common misgradings: reference/source-grading.md.

Done when every retained finding carries a two-character grade.

使用Admiralty（北约风格）体系：对每一项信息，分别用字母评级数据源和数字评级信息内容。

字母A–F：数据源的过往记录和获取渠道可信度。A=历史可靠，真实性无疑问；F=无法评估。
数字1–6：内容是否得到其他独立数据源的证实，以及本身是否符合逻辑。1=已被其他来源证实；6=无法评估。

独立性至关重要：企业注册文件评级为B2，知名报纸对该文件的报道最多评级为B2，而匿名论坛转载该报道的内容评级为D3——这不算新的佐证。评级针对的是你实际接触的数据源，而非它声称的来源。完整评级表、示例及常见错误评级详见：reference/source-grading.md。

完成标志：所有保留的发现都带有两位字符的评级。

Step 6 — Test hypotheses against each other

步骤6——交叉验证假设

Analysis of Competing Hypotheses (ACH) exists because the natural mode of investigation — pick the likeliest story, look for support — always succeeds. Support is easy to find for any plausible story.

List every hypothesis including the boring ones ("it is a different person with the same name", "the account was sold", "the shared IP is shared hosting"). Build a matrix of evidence against hypotheses, and for each cell ask only whether the evidence is consistent with that hypothesis. Then work by column: the hypothesis with the fewest inconsistencies wins, not the one with the most support. Evidence consistent with every hypothesis has no diagnostic value — the subject having a LinkedIn does not distinguish anything. A handful of diagnostic items beats a hundred consistent ones. Worksheet and a filled example: reference/ach-worksheet.md.

Done when you have listed at least one hypothesis you did not want and recorded what evidence would refute your favoured one.

竞争假设分析（ACH）的存在是因为调查的自然模式——选择最可能的结论，寻找支持证据——总会成功。任何看似合理的结论都很容易找到支持证据。

列出所有假设，包括看似无关的（「是同名的不同人」「账号已被出售」「共享IP来自共享主机」）。构建证据与假设的矩阵，针对每个单元格仅判断证据是否符合该假设。然后按列分析：不一致项最少的假设获胜，而非支持证据最多的。符合所有假设的证据无诊断价值——调查主体拥有LinkedIn账号无法区分任何情况。少数具有诊断性的证据胜过大量一致性证据。工作表及填充实例详见：reference/ach-worksheet.md。

完成标志：你已列出至少一个你不希望成立的假设，并记录了能推翻你偏好假设的证据。

Where this goes wrong

常见失误

Confirmation bias, OSINT edition. You are given a name and told the person works in logistics. You find a logistics profile and stop asking whether it is a different person with the same name. The tell is that your discriminators disappear once you find a candidate — you selected on them to find, then stopped applying them to test. Fix: before you search, write the attributes the true subject must have and the ones they cannot have; check every candidate against both. Rejections are findings and belong in the report.

Circular reporting. Three sources agree, so you grade it confirmed. All three copied one blog post, or all three pull from the same aggregator or the same leaked dataset. This is the single most common cause of confident wrong attribution, and it is invisible unless you look for it. For each corroborating source, find its origin: check publication dates in order, look for identical phrasing or a copied typo, and check whether the "independent" people-search sites resell the same broker feed — see

dig-through-data-brokers

. Independent means different collection, not different websites.

Stale data presented as current. Registries, WHOIS, and broker records carry the date they were captured, not today's truth. Record the observation date next to every fact; archive the page via

read-deleted-pages

Selector drift. Each pivot carries the risk that you have changed people. A chain of five pivots each 90% likely is a coin flip. Re-anchor: after every pivot, state which confirmed selector ties the new one to the subject.

Tool output as evidence. An enumerator's hit list, a breach aggregator's match, a face-search score — these are leads. The tool did not verify identity; it matched a string or a vector.

OSINT版确认偏差：你拿到一个名字，被告知此人从事物流行业。你找到一个物流从业者的资料后，就不再确认是否是同名的不同人。典型特征是：找到候选对象后，你最初设定的鉴别依据就消失了——你用这些依据来寻找目标，却不再用它们来验证。解决方法：搜索前，写下真实主体必须具备和绝对不能具备的属性；每个候选对象都要对照这两类属性检查。排除候选对象的过程也是调查结果，应写入报告。

循环报道：三个来源达成一致，所以你认为内容已被证实。但这三个来源都复制了同一篇博客，或都来自同一个聚合器、同一泄露数据集。这是导致自信但错误归因的最常见原因，除非主动排查否则无法发现。针对每个佐证来源，追溯其原始出处：按发布日期排序检查，寻找相同措辞或复制的拼写错误，确认「独立」的人物搜索网站是否转售同一经纪商的数据——详见

dig-through-data-brokers

。独立性指的是收集渠道不同，而非网站不同。

将陈旧数据当作当前信息：注册信息、WHOIS记录和经纪商数据标注的是采集日期，而非当前真实情况。为每个事实记录观察日期；通过

read-deleted-pages

存档页面。

Selector偏移：每次Pivot都有可能转向无关人员。五次准确率90%的Pivot串联起来，结果的可信度就像抛硬币。解决方法：每次Pivot后，明确说明哪个已确认的Selector将新Selector与调查主体关联起来。

将工具输出当作证据：枚举工具的命中列表、泄露聚合器的匹配结果、人脸搜索分数——这些只是线索。工具并未验证身份，只是匹配了字符串或特征向量。

Confidence grading

可信度评级

Applies repo-wide unless a technique skill says otherwise.

Confirmed — two or more genuinely independent sources (different collection, not different sites), or one authoritative primary record such as a signed registry filing, plus nothing contradicting.
Probable — one strong source, or several weak ones that survived a circular-reporting check, with the alternative hypotheses tested and weaker.
Unconfirmed — a single uncorroborated lead. Say so in the report; do not quietly promote it because later text depends on it.
Rejected — contradicted. Record it and why.

除非技术类技能另有说明，否则本评级适用于整个仓库：

已确认——两个或多个真正独立的来源（收集渠道不同，而非网站不同），或一份权威原始记录（如签名的注册文件），且无矛盾信息。
大概率——一个可靠来源，或多个通过循环报道检查的弱来源，且已测试过替代假设并证明其可信度更低。
未确认——单一未佐证的线索。报告中需明确说明；不要因后续内容依赖它就悄悄提升其可信度。
已排除——存在矛盾信息。记录该结论及原因。

When to stop

终止时机

Stop when the objective question is answered to the confidence the decision requires, or when you can document that available open sources cannot answer it and name what would (a records request, a subpoena, interviews). "We could not establish X, having checked A, B and C" is a deliverable, and often the honest one. Stop also when you cross a scope boundary — that is a re-authorization event, not a judgement call to make mid-flow.

Done when the objective is answered or documented as unanswerable, and

write-the-intel-brief

has been run.

当目标问题已得到决策所需的可信度答案，或你能证明现有开源数据源无法解答该问题并说明所需的补充手段（如记录请求、传票、访谈）时，停止调查。「我们无法确认X，已检查A、B和C」是有效的交付成果，且往往是最诚实的结论。当你超出授权范围时也需停止——这需要重新授权，而非调查过程中的主观判断。

完成标志：目标问题已得到解答或被记录为无法解答，且已运行

write-the-intel-brief

。

Worked example

实例演示

Objective: is the supplier

Nordvale Trading

on this invoice controlled by the ex-director of a barred entity? Discriminator: a director DOB month/year.

x-ray-a-company

returns a registry record with a director "A. Kestrel", DOB matching, address a mail-forwarding suite. Two people-search sites and a business-listing site all show the same home address for A. Kestrel — apparent corroboration, until each is traced back and all three carry the same misspelling of the street name from one broker feed. Circular; graded D3 and dropped.

Competing hypotheses: (1) same person, (2) different A. Kestrel, (3) name used as a nominee. Diagnostic item: the barred entity's filings and Nordvale's list the same unusual accountancy firm, and the domain in the invoice footer shares a registrant email with the barred entity's old site (

who-owns-this-domain

). That is inconsistent with (2), consistent with (1) and (3). Reported as probable, with the nominee hypothesis flagged as untested, and the gap named: beneficial ownership is not disclosed in that jurisdiction.

目标：发票上的供应商

Nordvale Trading

是否由某受限实体的前董事控制？鉴别依据：董事的出生年月。

x-ray-a-company

返回的注册记录显示董事为「A. Kestrel」，出生年月匹配，地址为邮件转发套房。两个人物搜索网站和一个商业名录网站都显示A. Kestrel的同一家庭住址——看似佐证，直到追溯发现三者都源自同一经纪商数据，且包含相同的街道名称拼写错误。属于循环报道，评级为D3并被排除。

竞争假设：(1) 同一人，(2) 同名的不同人，(3) 姓名被用作代持。诊断性证据：受限实体的文件和Nordvale的文件列出了同一家罕见的会计师事务所，且发票页脚的域名与受限实体旧网站的注册邮箱相同（通过

who-owns-this-domain

确认）。这与假设(2)矛盾，符合假设(1)和(3)。最终报告结论为大概率成立，同时标注代持假设未被验证，并指出信息缺口：该司法管辖区未披露实际所有权。

Pivots

Pivot关联

Every workflow feeds

graph-the-network

while it runs and

write-the-intel-brief

at the end. Selector-to-skill routing is Step 4; the technique skills each list their own pivots.

所有工作流运行时都会同步到

graph-the-network

，结束时会运行

write-the-intel-brief

。Selector到技能的路由详见步骤4；各技术类技能会列出自身的Pivot关联。

Legal notes

法律提示

Public availability is not permission. Data-protection law applies to aggregation of public personal data, and the aggregate is more sensitive than any part. Terms of service govern automated collection even where the data is public, and scraping disputes turn on authorization and contract, not on whether the page was visible. Never authenticate to, probe, or send traffic at systems belonging to the subject without written authorization.

公开可获取不代表有权使用。数据保护法适用于公开个人数据的聚合，且聚合后的敏感度高于单个数据。即使数据公开，自动收集仍需遵守服务条款，爬虫纠纷的核心是授权和合同，而非页面是否可见。未经书面授权，切勿对调查主体所属系统进行身份验证、探测或发送流量。