I have a deep passion for OSINT. I came out of the closet in my late teens, which means I sharpened my teeth lightly stalking crushes on LiveJournal and MySpace. Years later, the tools have changed as my instincts age like a fine wine. Notice the details, preserve the anomalies and artifacts, pivot carefully, and never assume one profile tells the whole story.
The seed image
Visible OSINT clues from the screenshot:
Komoot profile: https://www.komoot.com/user/5667624959835
Handle: JJ ^_^
Platform clue: Discord-style chat screenshot
Lifestyle clues: hiking, cycling, route logging
Likely next evidence source: Komoot profileKomoot recon
Meet Jim Lee.
Former hacker, “trying to turn his life around.” Newfound love for the outdoors, and hopefully also sunscreen after hacking in a basement away from sunlight around the clock. He’s also seen running in his animated profile photo. It’s unclear if he’s running from the police or enjoys running outside in skaterboi shoes and a baseball cap.
Follows no one, has 213 followers. As the kids would say, “very sus.”
Jim links to a GitHub from his profile. Images can be opened in a new tab at full size.
The flat-earth image enlarged:
The URL for that image:
https://tourpic-vector.maps.komoot.net/user_tour_summary/?hash=H4sIAAAAAAAA_zMDABR6uB0BAAAA&width=1920&q=80
The profile image URL structure is notably different from the flat-earth image. Same platform, different hosting path. Worth noting for later.
GitHub enumeration
Critical findings:
- Jim owns a company: Jim Lee Security Consulting
- One pinned repo
- The only active day in the past 12 months is April 16, 2026, with 3+ contributions
- Jim mentions running again on his GitHub bio
The commits from April 16 are visible once that date is clicked. It coincides with the day Jim joined GitHub.
Hunter.io is my first instinct for information on Jim Lee Security Consulting. That’s the professional-engagement brain. Recalibrating for the room.
A quotation-enclosed Google search for “Jim Lee Security Consulting” leads only back to the GitHub, meaning the company name is likely a fabrication.
Social media pivot via handle
Searching for JimL33t (nice play on hacker words, Jim) surfaces a Threads profile. One of the posted images shows the surrounding area near Jim’s location:
No replies, no additional media, no reposts on Threads.
Back to Google for JimL33t: another Threads link appears, seemingly reposted by @blueloycristina, who populated search results after commenting on one of Jim’s posts. The comments section appears several times across two pages of results.
CTRL+F for “Jim” and “JimL33t” returns nothing. It’s hiding in the comments. Tab left open.
Jim also has an Instagram and actually follows humans on this account. Tab left open.
Location recon via image
Google Image search on Jim’s Threads photos. Business sign visible: IRIGATII.RO. Romanian URL.
Confirmed:
Firefox translation applied:
Contact page in English. Irigatii.ro must do great work. Look how green everything is around their business location:
Street address pulled into Google:
Fruitful. Tab left open. The pieces are converging.
GitHub commit metadata
Back to GitHub. More to enumerate.
On the pull request “Clean up README by removing comments” > Files Changed > expanding all available:
jimleepro1-cell/jimleepro1-cell is a ✨ special ✨ repository because its README.md appears on your GitHub profile.WAIT. The commit hash. As an active GitHub user, I know the commit hash works as a direct URL.
The hash can be copied to the right of “Verified.”
There’s something to be said for the merge request as well. Someone opened a PR against Jim’s repo, and the commit may preserve the change even if it was never merged.
Full SHA: 65583ca88efce74e56182b5541362448a2e926c5
Testing the hash directly:
github.com/jiml33t/jiml33t/tree/65583ca88efce74e56182b5541362448a2e926c5
Who is ytdexter00-creator? YouTube is the likely platform for that prefix.
Raw README via the hash:
raw.githubusercontent.com/jiml33t/jiml33t/65583ca88efce74e56182b5541362448a2e926c5/README.md
GitHub supports a patch view by appending .patch to the PR or commit URL. Curling the API:
curl -s https://github.com/jiml33t/jiml33t/pull/4.patch | lessNothing there. New approach: the oldest raw README is the best “before cleanup” snapshot. Jim ran three sweep commits after the first one.
Pull request details:
curl -s https://api.github.com/repos/jiml33t/jiml33t/pulls/4 | jq
On the right path. The very first commit is most likely to carry what needed to be removed.
List all commits oldest-first, with full author metadata:
curl -s "https://api.github.com/repos/jiml33t/jiml33t/commits?per_page=100" \
| jq -r 'reverse[] | "\(.sha) \(.commit.author.date) \(.commit.message) \(.commit.author.name) <\(.commit.author.email)>"'
Bingo. Found his email.
Email interaction
A Google search for the email returns nothing. Jim’s Komoot profile was clear about his pivot away from hacking. An out-of-office auto-reply is worth testing.
Yes. There absolutely is.
Full name: Jim Lee
Email: [recovered from GitHub commit metadata]
Phone: [Romanian mobile, recovered from OOO auto-reply]Romanian phone number. The Irigatii.ro location is now the anchor for city and transit station.
Location resolution
Google and Gemini defaulted to tourist/city-center framing until the query was reframed:
The answer is three words. Digging into the AEM junction and surrounding region:
City: Timișoara
Train station: Piața Gheorghe Domășneanu
Complete OSINT Chain
Seed image
-> Komoot profile ID
-> Jim Lee identity
-> linked GitHub
-> reused handle JimL33t / social pivot
-> GitHub commit metadata
-> email recovered from first commit author field
-> authorized email interaction
-> OOO auto-reply returned Romanian mobile number
-> Romanian location clues
-> Irigatii.ro / Timișoara
-> transit correlation
-> Piața Gheorghe DomășneanuFinal answers:
- Full name: Jim Lee
- Email: [recovered from GitHub commit metadata — first commit, author field]
- Phone: [Romanian mobile — recovered from OOO auto-reply]
- City: Timișoara
- Tram station: Piața Gheorghe Domășneanu