Tal Hagin Profile picture
OSINT Analyst | Media Literacy Educator | Focused on Information Warfare Content is my own unless otherwise stated
6 subscribers
Dec 16 6 tweets 3 min read
Remember the fake site built to spread disinformation?
It claimed the bystander who disarmed one of the shooters wasn’t Ahmed al-Ahmed, but “Edward Crabtree.”

Let’s break down everything wrong with the site - 🧵Image First of all, the site is "attempting" (very badly) to mimic the real news site, "The Daily Aus" - It just got literally everything wrong: Image
Image
Dec 14 7 tweets 6 min read
Based on the available visuals, it appears (Based on current video evidence) that both gunmen arrived prepared with two firearms each: two hunting rifles and two shotguns.

A Timeline 🧵Image Current visual information:
1. In the phone and drone footage, one of the individuals who is shot appears to be holding/laying by a firearm (likely a rifle) near the back right side of the vehicle at the moment they are hit. The exact weapon type cannot be confirmed from the footage alone.

2. The vehicle seen parked next to the bridge matches a car reportedly associated with one of the shooters’ home addresses (based on the license plate allegedly linked to him).

3. In the phone footage, a visible interaction visible is seen between one of the victims and a shooter.Image

Image
Image
Dec 14 6 tweets 3 min read
Based on the video, after shooting at two individuals in close proximity, they direct almost* all subsequent gunfire toward the south-east.

Their immediate line of sight, shown by the red movement line, points south-east toward the gathering point of the Hanukkah celebration, marked by the white circle.
Image
(Per my analysis of the video) The shooting does not appear to be random or indiscriminate.
The two individuals were likely shot due to their close proximity or an attempt to intervene. At 1:31, the shooters can be seen actively warning people to the north, where filming is taking place, to move away.
Dec 13 9 tweets 5 min read
What do you get when you mix a redacted photo from the Epstein estate with AI-enhancement tools?
Nothing good, or real.
A 🧵 Image
Image
Image
Image
The original image was released with the women’s faces blurred. Naturally, people wanted to know who they were, and some turned to AI to “enhance” the image.
edition.cnn.com/2025/12/12/pol…Image
Sep 13 8 tweets 2 min read
It will never cease to amuse me that the agenda or circumstances surrounding any major event will always fall directly in line with whatever core belief a “truth seeker” holds.

They begin with a conclusion, and just jerry-rig “evidence” to fit it.

Wanna test it yourself? Image Go to any self-proclaimed truth seeker and figure out their core narrative:
1. Hatred of left/right wing people
2. Hatred of a religious/ethnic group.
3. Hatred of a racial group.
4. Or the recurring hits: “This is a conspiracy,” “False flag,” “It’s staged.”
5. Etc
Sep 5 15 tweets 7 min read
On Jan 5, 2025, @elonmusk said:
“Grok will be the best source of truth by far.”

Beyond this, users have relied on the X LLM, known as Grok to verify information, even attempting to use its replies as Community Notes.

But can we really rely on Grok?🧵Image We mostly see Grok being tagged in comment sections, being asked:
“Grok, is this true?”

This tells us something really important:
People want to verify information they see on their feed.

In theory, that’s great - People aren't blindly believing posts. But there’s a big catch.Image
Aug 27 7 tweets 4 min read
I've been seeing people pick & choose which phrases to show that were written on the Minneapolis shooter, depending on the narrative they are trying to formulate.

Here is a complete list of every(122) phrase written on the weapons and magazines, and their (likely) meaning:Image Note:
After reviewing nearly everything I could (some words were difficult to decipher or translate from Russian*), it appears that the shooter was fascinated by what many would describe as “Internet culture”—albeit its more extreme end.
Aug 21 13 tweets 5 min read
One of the reasons I follow a wide range of accounts across the political spectrum is to gain insight into how each side views the same event, and hints that misinformation is being spread.

Take this incident that occurred outside an Egyptian government office in New York yesterday:Image These 3 posts all appeared on my timeline in one continuous scroll. However, you'll notice that they cover the same exact incident differently:
Aug 20 4 tweets 2 min read
Aug 11 9 tweets 5 min read
The message isn't fake, but deleted - There are 2 ways to prove this:
1. Forwarded Messages
2. Link ID

A short🧵

To Clarify: This thread is strictly about verifying a specific claim, and to help others with methods to verify the existence of deleted Telegram messages.Image 1. Forwarded Messages - While the message was deleted in the main channel, it wasn't in the discussions "Group".

How to find it: Go to Al-Sharifs Telegram > Click on "Leave a comment" under any post > Then "Join Group" > It'll appear in your Chats > Click on it and search "9 ساعات" > It'll show up for you - Written and forwarded by Al-Sharif to that group.

1. Link to the "Group Chat" - t.me/anas1020304050…

2. Link to Al-Sharifs Channel - t.me/anas1020304050
Aug 3 4 tweets 2 min read
Deepfakes are commonly based on existing footage - This one is based on a Subcommittee hearing from 2022.

But, if you didn't know how Omar sounds or weren't aware of the "Meme" reference, it's very possible you'd fall for this.

Here is the original footage: What the Deepfake does:

It uses existing footage, learns the movements of the target, and then includes fabricated audio and lip movements on a frame taken from the original clip - for this, it used the following photo that was shared a lot: Image
Aug 3 12 tweets 6 min read
This particular video has been accused by many of being AI-generated, either citing an anomaly on the individual's hand or the use of AI detectors.

So is real or fake? I believe it to be authentic.

Why?🧵 Image The main anomaly mentioned by users is the person's right hand, which appears to have a sixth finger growing on his middle finger.
AI still tends to mess up this type of detail, so it immediately resulted in the video being labeled as such.
(Using the evidence links provided in the proposed CN link)Image
Image
Image
Jul 28 5 tweets 3 min read
As I've said on several occasions, no source? Ignore.

Grok said that the following image was from Iraq in 2014, in an attempt to debunk the claim that it was a recent photograph from Gaza in 2025. The issue? It provides 0 source.

Also, Grok is wrong - It's from Gaza.🧵 Image
Image
All it took to make Grok backtrack its claim was asking for evidence and providing it with 2 angles of the girl - Took 3 replies.

See our full conversation here:
x.com/i/grok/share/V…Image
Jul 4 15 tweets 6 min read
With the publication of the following footage, so to came with it suspicion that it was AI, or at least partially, specifically the second video.

The doubts aren’t unfounded — but after a thorough review, I believe the footage is authentic. Here's why:

A🧵 As AI technology advances, so does our skepticism toward video footage. Visual oddities that were once dismissed as typical artifacts are now increasingly seen as undeniable signs of AI fakery.

So, what raised suspicion in this case? Four main things — but one frame in particular stood out.
Jul 1 17 tweets 11 min read
A viral claim alleges that over 1,000 Israeli deaths—military and civilian - were exposed via a hack of the Israeli "Hess" website, due to Iranian strikes.

But is there any truth to it—and can we even know, given Israel’s military censorship?

A🧵 The official numbers, per Israeli/Palestinian media (TOI/Maariv/Palestine Chronicle/MOH), cite 29 deaths (28 civilians / 1 off-duty soldier) and 3,000+ injured, but the death toll could rise as there are still several in critical condition (As of June 24th).

Sources:
TOI (They are missing 1 name: Yelena Zadovsky)
timesofisrael.com/these-are-the-…
Maariv:
maariv.co.il/economy/israel…
Palestine Chronicle:
palestinechronicle.com/israeli-media-…
MOH:
gov.il/he/pages/24062…Image
Image
Image
Image
Jun 30 5 tweets 2 min read
1. The Times of Israel headline is misleading. If you actually read the article, it's clear they're referring to Iranian casualties.

2. I couldn’t find any Israeli outlet named “Hess,” let alone one reporting those numbers. Image “Iranian strikes” clearly means Israeli strikes on Iran — just read one sentence past the headline.

Tip: Read articles before you share them. Image
Jun 25 7 tweets 5 min read
As news broke of a young child being violently slammed into the ground at Moscow’s Sheremetyevo Airport, so did speculation about the attacker’s identity.

What isn’t confirmed:
Claims that the attacker is Jewish or a Zionist have circulated online without ANY evidence. The only official reference appears in Iran’s Tasnim News Agency, where Ambassador Kazem Jalali stated: “Some have claimed the attacker is Jewish, but I cannot confirm that.”

What we know:
The perpetrator is Vladimir Vitkov, 31, a Belarusian national, returning from Egypt, where he had been working on a construction project. He was reportedly under the influence of whisky and cannabis at the time of the assault.Image
Image
Image
Image
This is a good time to remind everyone of the Ben Cohen case - which led to an innocent man being harassed for a crime he didn't commit because people were desperate to paint a narrative that fit their agendas - trying to claim the perpetrator was either Israeli/Jewish/Illegal Immigrant/Muslim:
Jun 19 10 tweets 5 min read
In a renewed attempt to claim that Soroka Hospital wasn’t directly hit—but was instead damaged by a shockwave after targeting two alleged military facilities—a new video has been released.
Just like previous “evidence,” it’s wrong: The roof of Soroka’s Surgical Ward was directly struck, and the supposed military sites are not located where the video claims.

Thread 2.0:Image The Claim:
This video repeats the same narrative, but instead of a fake map, it now shows a 3d image of Soroka Hospital in Beer Sheva —while still insisting the location is in Tel Aviv.

The translated claims are:
1. “Central Command of Communications, Control and Intelligence of the Israeli Army”
2. “Central Intelligence Building – Israeli Army Operations in Tel Aviv's Gav Yam Technology Park”

This is false.
Jun 19 15 tweets 7 min read
After the blast at Soroka Hospital, Fars News claimed it was just shockwave damage from nearby military targets. This is False.

The hospital was directly hit, and the map they shared to back up their claims was completely fabricated.

An OSINT Analysis by @FakeReporter :Image Be aware that this analysis uses open-source tools, including geolocation, blast triangulation and publicly available information online - Nothing said here is confidential.
Jun 19 5 tweets 2 min read
The entire city is blurred on Google Maps: Image
Image
Image
Image
Source: Google Maps
Jun 13 94 tweets 44 min read
Mis/Disinformation Thread - Iran/Israel 2025

This thread is for you to be aware of what reports/photos/videos are verified Fake News (with sources).

1. This video is from Kyiv, Ukraine - 2022 (Source: ).Image 2. This video is from a fire in Iran on June 11th, 2025 (Source: ). Image