Doesn’t everybody know how to find people on Facebook or Instagram?
True, in some cases you just type in the real name and surname of the person you wish to find into the Facebook or Twitter search bar and receive instant results.
But what if the information is not that straightforward to get?
Here are some more elaborate methods of finding people online:
1. Use people search websites
A good people search website can be a real goldmine of information, or be an absolute privacy violation, depending on your needs and your point of view.
Using OSINT for searching people located within the European Union received a serious hit with the arrival of GDPR mid-2018.
Many websites that previously contained personal datasets had to simply remove them and even information like email addresses or phone numbers was no longer searchable.
However, for targets outside the EU, these people search websites can still provide a valuable source of intelligence.
Many of these websites started off as free services, but as they built up their records and started receiving increased traffic, they shifted to a paid model.
Here I will focus on examples of free people search websites (US only):
https://www.truepeoplesearch.com – no account or signup required, allows you to search for people, phone numbers, addresses (including reverse look-ups).
https://www.zabasearch.com – scans public records, such as court records and phone directories. You can search by the person’s phone number or name. If you have an ad-blocker, switch it off as the site won’t load until you do. Ads galore.
https://www.peekyou.com – apart from basic name and surname searches, you can search for social media usernames. Also, full of ads.
2. Search for obscured account names
For many people the urge to put out their personal information on Facebook or other social media sites is irresistible. They do however take some precautions to obscure their names and to throw off the site search engines and potential lurkers.
The common methods of obscuring account names are:
a) substitution – where letters in a name are replaced by other characters, typically numbers.
For example: Alan Harrison = Al@n H@rr1s0n.
b) transliteration – where a word from the alphabet of one language is transferred to another (in this case name / surname). There could be various examples of this.
Russian speakers might write their name in both Cyrillic or Latin alphabet:
Пётр Воробьёв = Pyotr Vorobyov
(useful site for Russian names in English)
Irish people might use the Irish version of their name instead of the English one:
Frank Faulkner = Frainc Ó Fachtna
(check out this site for Irish to English name conversion)
c) abbreviation – where instead of creating an account with full name and surname, a person will only uses parts of one or both.
For example: Kyle Johnson – Ky Le; Ky John; Kyle J, etc.
3. Check various classified ads websites
Many people advertise their cars, products or services online on websites like Gumtree, Craigslist or their local equivalents.
It can be hugely beneficial to run searches on a target’s name on those sites. Some people avoid creating an account using their real name, but then they have no problem including their contact details within the body of their advert, including of course their phone number.
4. Check online notice websites
There are plenty of websites out there that notify the general public about some important personal event or occasion – a birthday, a marriage, an anniversary, or a death.
These websites are not designed to be viewed as sources of information, yet they can deliver a surprisingly substantial amount of content to somebody who is interested in finding a specific person.
Example:
This well-meaning, family oriented notice betrays the following information:
- Full name and surname as posted;
- Photograph of the person;
- His age and date of birth that can be calculated backwards using the “Uploaded” and “Published from” dates;
- Local newspaper the notice was also published in – indicating the town where this person likely lives.
Similarly, death notices can contain a huge amount of information – and not about the deceased person, but the others who get a mention in the narrative.
Example:
R.I.P. Notice [redacted]
[redacted] died peacefully at home on 25th October 2018, aged 88 years, [redacted]. A beloved wife of the late [redacted], a loving mam to [redacted], a special grandma. Loved and sadly missed by [redacted]. Funeral Service at St Mary's Church [redacted], on 4th November at 11.00am, followed by cremation at [redacted]
A notice like this practically maps out the closest family of the deceased, who is identified by name and surname, and sometimes even home address. Combined with additional information like the local church, local graveyard and other details disclosed in the notice, it is possible to gather substantial amount of intelligence from a seemingly irrelevant source.
5. Hunt for a curriculum vitae
During a job hunt eager job seekers send their CVs and resumes everywhere, but does anybody ask the question what happens with those documents?
The cliched adage goes: what appears on the Internet, stays on the Internet.
Forever. And in many cases this is true.
Resumes, motivational letters, CVs and similar content can linger on cloud based platforms or other publicly available services. These can be searchable by search engines and could be retrieved in the following format:
“name surname” “Curriculum Vitae” (or “CV”, “Resume”, etc.)
“name surname” “Curriculum Vitae” filetype:docx (or pdf)
“name surname” “Curriculum Vitae” site:docs.google.com (or another site)
It is scary that even without searching for specific personal details, you can still come across CVs belonging to real people, populated with real information!
This is it for now.
Keep an eye out for more practical info in the Osint Me setup thread!
people search websites are kind of nonsense cos they make you pay to see results. your wasting your time covering this
Hey
Thanks for the info Matt I am new to this and am finding your stuff very informative and helpful
Could I request you do a thread maybe for Tricky Thursday about the best practices when setting up OSINT profiles ?