A Free OSINT Lesson: Everyone Just Wants to F*ck...
Can I say "Fuck?"
There’s this silly idea that OSINT and investigations are some cerebral game of cat and mouse, and sure, sometimes we have those Holmesian (is that a word?) moments; but dumb luck often plays a huge role. This is one of those moments.
Ok, so I need to be really clear here. Sex is great; but the human sex drive is just this giant walking-talking operational security risk ready to get railed, and I don’t know how to say this any more clearly… but all your online sex shit should be separate from the rest of your life.
Now, before I get into the lesson here, you should read this article I wrote about how the South African government published the private emails of its parliamentarians. Straight up… just phone numbers and Gmail accounts all over the damn place on the government website. And when the team from OSINT.Industries (a great tool, by the way) started running all those emails and phone numbers through their various modules… you can imagine all the shit that started coming back… and of course… there was some porn. Pornhub accounts. Xvideos accounts. One RedTube account… no judgement, you horn dog you.
Long story short, if you want to see a perfect example of terrible operational security…go check out South Africa’s Parliamentary website.
Ok, back to the sex—
So I had this intelligence tasking, and you know the drill. I can't say much beyond that. This guy was breaking the law, defrauding people, and I was asked to provide a target report. One of the client's requests was to find any photographs of this individual since the few that existed were fairly unclear or his face was partially covered.
A long shot. I'm no miracle worker. This dude has been evading law enforcement for almost a decade. An expert flim-flam artist. In short, I said, "No promises, but I'll do what I can."
I have a name and an email. I start going down the list, just collecting as much information as possible. I run the email through some tools we use. I run the user name of the email (the stuff before the "@" sign). I run through various iterations of other possible emails he could have… long story short, selectors start popping up, and, as all you little OSINTers know, the red string starts to show up as you tie stuff together.
I eventually found a Gmail account tied to the target. It was an old one from 2015, with one of those generic "first initial, partial last name, and birth month" email addresses, like "mban09@gmail.blah." You know, the kind you give to your mom so she can email you family updates, and you can avoid judgment of the usual email address you'd use with the words "spicy" and "69".
So I get this Gmail address hit and start running it down. A few interesting selectors here and there, but nothing great. Definitely no pictures. So, I turn to my personal favourite, breach data.
As an aside, let me just say, search.0t.rocks… RIP. If anyone knows a good alternative, please send me a message. While I love some of the paid tools we use, something a little extra would always pop up on 0t.rocks. I’m actually getting a little teary-eyed…
Ok… so as it turns out, this happened in 2016.
Adult Friend Finder. Data from over 300 million accounts get leaked.
And my target’s old Gmail account shows up in the breach. No effin’ way!
“Dope,” I say to myself.
At this point, I deserve a break. I’ve been plugging away for a couple of hours, and I haven’t had my Coke Zero yet (note: this Substack, Permanent Record Research, nor I have any affiliation with the Coca-Cola Company… it’s just a damn fine product).
I wander over to my fridge. Now, it must be noted that I recently purchased a case of Coke Zero ‘Spiced.’ It’s delicious. So I crack that ice-cold can open and take a long sip of the divine. And like some daemonic muse assaulting Plato’s brain, this thought enters my mind…
“This dude I’m trying to track down… he’s probably a horny motherf*cker…”
I can feel the Coke Zero Spiced nudging the little grey cells into action.
“Some thirsty night, he thinks to himself, ‘Maybe I can get laid?’”
The Spiced whispers in my thoughts, “Perhaps he uploaded a photo of himself…?”
“Perhaps,” I reply to the voice of Coke Zero in my mind.
This was also back in 2016 or so. He would have been younger. Hornier. Like a Parliamentarian from South Africa opening up a RedTube account, forgetting about it, and much later in life, letting his government publish that personal email to a website for all to see.
Like Paul Atreides in the desert, I hear the Spiced voice utter in a low strange whisper, “Search Adult Friend Finder.”
I opted for this search tool. There was no point in making an account if this didn’t pan out.
I go to the breach data and highlight the username that was tied to the old Gmail account.
CTRL-C.
“The Spiced must flow…”
CTRL-V.
I take another gulp of Coke Zero.
I press ‘Enter.’
There it is—a photo. Face and all.
“The sleeper has awakened!” I yell out.
After regaining consciousness from my strange spiced cola haze, I realized that to get the pictures in a larger size, I need to make an AFF account. Damn. Warming up an old burner email, I create a junk AFF account, verify the email, log in, and go to his page.
His biography matched some of my selectors—the city, the age range, the Gmail account. So, I started downloading all his photos. I flagged the site, took screenshots, archived it as best I could, and then went straight to PimEyes, as well as a couple of other image recognition websites, and I just started uploading.
From there, I rode the sandworm to Instagram, Facebook, his real name. All the selectors began to match, and my client received a nice little report.
“Oh wow,” they wrote in an email. “What gave him away?”
“He wasn’t using his brain but another organ,” I replied.