The odds of finding the Salisbury novichok poisoning suspects’ real identities seemed remote.

The man who called himself Ruslan Boshirov had no social media profiles, no publicly registered businesses or phonebook listings, and after giving a brief and bizarre interview on the state-funded RT television station earlier this month, many Russia watchers assumed he would simply disappear into the ether.

But in a series of blockbuster investigations, the online investigative journalism sites Bellingcat and The Insider presented a strong case to identify Boshirov as Col Anatoliy Chepiga, a highly decorated officer in the Russian military intelligence (GRU).

The investigation combined elements of old-school journalism, like tips from sources with knowledge of the Russian military, with powerful online search techniques, leaked databases of Russian passport documents, and a large dose of intuition.

Sergei and Yulia Skripal collapsed in Salisbury in March after being exposed to novichok

“We had no expectation we’d be able to make an ID,” Eliot Higgins, who founded Bellingcat in 2014 after pioneering a series of open-source investigations, told the Guardian. “But after our first article we had a number of people reaching out with additional information, and some of it was very specific information. The main challenge then was fact-checking and verifying the information we were provided with.”

Asked about those tips, Higgins said he couldn’t go into detail at this point.

Since 2012, when he began producing investigations into chemical attacks during the Syrian civil war, Higgins and other online investigators have managed to use novel investigative techniques, including analysis of online videos, to repeatedly pull needles out of haystacks. In 2013, Higgins, blogging as Brown Moses, attributed a chemical attack in the Syrian city of Ghouta to soldiers fighting in support of Bashar al-Assad’s government, mainly by studying munitions commonly used by the regime.

In 2014, after going public and launching Bellingcat, his investigators launched their most comprehensive investigation: into the downing of a Malaysian Airlines passenger jet over east Ukraine, killing 298 people on board.

The investigation combined journalists’ reports with CCTV cameras geolocated to show anti-air missiles making their way from Russia into Ukraine and toward the launch site, as well as social media photographs identifying the likely crew behind the missile launch and their officers.

For the Boshirov investigation, Bellingcat partnered with the Russian investigative journalism site The Insider, which had covered leaks of Kremlin correspondence by Anonymous International and the investigation into the downing of MH17.

Bellingcat has frequently sparred with Russian military and diplomatic officials, who have claimed without evidence that Bellingcat fabricates evidence and is a front for foreign intelligence services.

The Russian embassy to the Netherlands wrote on its verified Twitter account on Thursday: “Q: How much time does a couple of people thousands of miles away need to disclose a ‘true identity’ of an ‘intelligence officer’? A: Less than a month provided they use Google #TheTruthIsOutThere.”

Aric Toler, a lead researcher for Bellingcat, shot back, referencing one discovery from Bellingcat and The Insider’s investigation into why the two men had similar passport numbers: “Well, yeah, thanks to you guys being geniuses in doing things like handing out passports with consecutive numbers to your spies.”

The investigation, which has taken about a month, has largely emerged from leaked passport databases which showed that the two men probably had ties to the defence ministry, despite Vladimir Putin’s assurances that the men were civilians. Using those photographs and tips that GRU agents matching their profile would be likely to attend a military academy in Russia’s far east, investigators began combing photographs for men matching Boshirov and Petrov’s profile.

A group photograph with a man resembling Boshirov published by that military academy led investigators to begin searching for Anatoliy Chepiga, a Russian speznaz (special forces) veteran born near the border with China who fought in Chechnya and received the award Hero of the Russian Federation in a period when Russian officers were active in east Ukraine.

The group photograph with a man resembling Boshirov. Photograph: Bellingcat

While researchers did not confirm that the group photograph depicted Chepiga, a source with access to Russian passport databases gave them a photograph of Chepiga, taken around 2003, which “strongly resembled a younger ‘Boshirov’” in other passport photos released by Scotland Yard and Bellingcat.

That is likely to be a key point of contention, as Russian critics have said the two men simply look alike but that Boshirov and Chepiga are in fact different people.

Asked about a breakthrough moment, Higgins wrote: “As strange as it sounds, it’s when I saw his ear shape in all three photographs we had of him. It’s difficult to be 100% sure on facial matches, but something like the shape of the ears is very useful for confirming an ID, so that was as much... a Eureka moment as anything else.”

Roman Dobrokhotov, the editor of The Insider, said: “We didn’t really assess our chances, you never know beforehand. But of course we got really lucky.”

Bellingcat members have also said they will likely publish the identity of the second man, identified only as Alexander Petrov, in the coming weeks.

“We keep getting so much information we’ve had to pick and choose what we publish and when, so there’s more to come on this topic,” Higgins said, adding that he didn’t want to set a date for the release.

Scotland Yard have said they believe Petrov to be an alias. Both men have been charged with attempted murder and conspiracy in the UK. The Kremlin has said it will not involve itself in an investigation.