Grosint SMINT

NIA intercepts a burner SIM number from a hawala transaction. The number appears clean — no obvious social media presence, no caller ID registration. Traditional investigative tools return nothing. The number appears to be a dead end.

• T+0s — Burner SIM number entered. Parallel lookups initiated across all available data sources.
• T+3s — HLR query reveals the operator, activation circle, and SIM activation date. The number was activated 72 hours ago — consistent with a burner pattern.
• T+12s — Breach database returns a hit: this number appeared in a 2022 data exposure linked to an email address. The email was not registered under the same name as the SIM.
• T+30s — Email pivot on the discovered address reveals a VoIP account registered under a different name — a second identity layer.
• T+1min — Messaging app search finds the number registered in 3 private groups. Group names and membership patterns suggest coordination activity.
• T+4min — Social graph analysis connects the discovered identities to 2 entities on watch lists. The connection path traverses 3 identity layers that would have been invisible to manual investigation.
• T+6min — Complete intelligence package generated with full evidence chain from burner SIM to watch-listed entities.

A traveller at an international checkpoint presents documents that pass visual inspection. The border officer wants a rapid digital footprint check on the passport number and declared phone number before clearance. The queue is growing — the officer has less than 2 minutes for a decision.

• T+0s — Phone number and passport details entered into Grosint. Both lookups fire simultaneously.
• T+3s — Telecom intelligence confirms the number's operator data matches the declared nationality. Initial check appears clean.
• T+8s — Caller ID lookup returns a different name than the one on the passport. First discrepancy flagged.
• T+15s — Messaging app profile photo does not match the passport photo. Second discrepancy flagged automatically by the system.
• T+45s — Breach database check reveals the phone number was previously linked to a flagged email address associated with document fraud. Third discrepancy.
• T+90s — Grosint presents the border officer with a concise alert: 3 identity discrepancies detected, with source attribution for each. Traveller referred for secondary screening.

A phishing campaign targeting Indian banks uses rotating phone numbers for OTP collection. The cyber crime cell has extracted a list of 12 phone numbers from phishing kits. Each number appears unrelated to the others. Manual investigation of each would take the team weeks.

• T+0s — All 12 phone numbers entered for batch lookup. 12 parallel query sets fire simultaneously — over 100 individual lookups in total.
• T+30s — Initial results arrive. 7 of the 12 numbers share the same breach history pattern — all appeared in the same data exposure incident from the same source.
• T+2min — Messaging app analysis reveals 4 of the numbers are registered under similar naming conventions — sequential alphanumeric patterns suggesting automated registration.
• T+5min — Email pivot from breach data reveals a common recovery email address shared across 5 of the accounts. This email becomes the primary identifier for the operator.
• T+10min — Social graph analysis maps all 12 numbers to a single operator cluster. The operator's real identity surfaces through a UPI registration linked to the recovery email.
• T+15min — Complete evidence package generated. Every connection between the 12 numbers, the shared breach history, the common email, and the operator's identity is documented with source attribution.

A defence establishment employee is suspected of unauthorized contact with a foreign national. Counter-Intelligence has the foreign number but no other leads. The employee denies any such contact. CI needs to establish the relationship and map the foreign contact's identity — without alerting either party.

• T+0s — International number entered. Grosint initiates lookups adjusted for the foreign carrier and registration country.
• T+5s — Telecom intelligence reveals the carrier and country of registration. The activation pattern is consistent with the declared nationality.
• T+20s — Messaging app search finds the number registered in 2 groups with themes related to defence procurement. Group membership lists provide additional identifiers.
• T+1min — Breach database reveals the number's associated email appeared in a diplomatic contact list exposure. The email is linked to a specific institutional affiliation.
• T+3min — Email pivot discovers the foreign contact is registered on 3 messaging platforms. Profile data and display names are collected across all three.
• T+5min — Social graph analysis reveals mutual connections between the foreign contact's network and the suspect employee's known digital contacts. Two mutual connections confirmed.
• T+8min — Complete intelligence package: foreign contact's digital identity, institutional affiliation, group memberships, and mutual connections with the suspect. All evidence timestamped and source-attributed for CI reporting.