Skip to content

Tag: bookmarklets

Threads.net Is Hiding Some OSINT Secrets You Definitely Need To Know

Threads, you say? The Dane Cook of social media???
(Shout out to the Archer fans out there who got that obscure joke)

If you’ve been on Instagram over the past year, you’ve no doubt seen some profiles sporting that strange, extra squiggly looking @ symbol and perhaps you’ve even accidentally waded into Meta’s head-scratching approach to microblogging (think Twitter. yes I know it’s X, no one cares).

That little symbol on a persons Insta serves as a gateway to Threads.net and while you may have ignored it in the past, I’m going to tell you several really important reasons you’ll want to make is a part of your next SOCMINT adventure. I won’t be taking the time to fully break down the platform for you, apologies to everyone who anxiously awaits my next long-winded blog post (hi mom). For this write-up, it’s just the hits.

Clicking on the Threads icon on an Instagram profile will take you to a page that looks something like this, without requiring login to access:


Tip #1: Just because you don’t see the @ symbol linked on an Instagram profile, doesn’t mean the user doesn’t have Threads.

That’s right! Users need not link to Threads on their Instagram profile, and I’m finding more and more that users do in fact have a Threads account, yet nothing is shown on their IG. Now I check for Threads every time I see an IG account. This revelation is more important than you might realize. (More on why in the following tips)

So how do we get there when no link exists? The simple way is to append the Instagram username to the following URL:

https://threads.net/@___________________

Not simple enough for you? Ok fine, in the true spirit of Midwest Nice, I went ahead and made a push-button solution for you, a simple bookmarklet you can place in your browsers bookmark bar and click any time you’re on an Instagram profile. This will grab the IG username and open a Threads tab to check for the presence of an account there for you at the push of a button.
You’re welcome, and I’d better see a 2 finger steering-wheel wave out of you if we ever pass each other on a gravel road someday.

Access the bookmarklet and instructions for using it, alongside our library of other awesome OSINT bookmarklets at https://tools.myosint.training OR copy and paste the below code into a bookmark you add to your browser:

javascript:(function(){var url=window.location.href;if(url.includes("instagram.com/")){var username=url.split("instagram.com/")[1].split("/")[0];var newUrl="https://threads.net/@"+username;window.open(newUrl,"_blank");}else{alert("This is not an Instagram page.");}})();

Tip #2: Despite sharing the same username as the person’s IG profile, Threads DOES NOT have to have the same pic or bio.

This is big! Those of you conducing online research know that it can be the smallest digital breadcrumb that breaks open your investigation. User supplied information is the centerpiece of successful pivoting, and knowing there’s another bio hiding on Threads can be an absolute game changer and in some cases, can help with validating that you have the right user on Insta, when that profile was set to private.

On top of all this, when an Instagram profile photo doesn’t reveal anything useful, there might be a much more helpful photo just a click away in Threads. Like here:

Bonus tip for you…
Wondering how you can easily access the full Instagram profile photo without having to right click on the page, Inspect, and work your way around the source code? We’ve got a free bookmarklet for that too! One click and the profile photo, in full size, is opened in a new tab enabling you to save it.


Tip #3: Follower/following lists on Threads are set to public by default, regardless of the person’s Instagram privacy settings.

These days more and more I run into private Instagram accounts where the follower/following lists are not clickable and therefore not searchable. Threads, on the other had, I’ve found to be most often public. Being able to examine the connections to someone’s social media account is a HUGE benefit for our investigations. I could probably write a whole blog just on different stories of times where a public list of connections opened otherwise completely unfindable doors.

Now, follower/following lists on Threads are not apples to apples vs a user’s Instagram follower/following, of course. I consider the Threads connections to be (mostly) a subset of the person’s IG connections. Here I’m making an inference, but what this allows me to do is pivot off to other users on the Instagram platform who may have more publicly available profile info or have more uncommon names, making my subject’s circle of friends and family more easy to find on other platforms. And in the absence of public access to IG followers, well I’ll take anything I can get. There’s an art to this, my friends!

Bonus tip for you…
When an IG follower/following list is publicly viewable, remember that the accounts appear in the order they were added, meaning the first account followed is all the way at the bottom. Why is this important? Well, when I’m looking for someone’s 2nd, 3rd, or beyond social media account, or when I need to find a more current account for someone and only have an old one… knowing who they first followed can give me a short list of accounts who may be important enough in my subject’s life that any additional accounts they might have would also follow some of those same people.

Oh, I do need to add at least 1 disappointing thing, lest the internet trolls come complaining in the comments… In order to view the follower/following lists on Threads, you do have to be logged in. The rest of what I mentioned is all wide open, at least for now. One thing you can ALWAYS count on with Meta is that something on their platforms will change, the moment you start to like it.

That’s it for this one. Sorry for the long delays between blogs, but hopefully you’ve caught some of the other OSINT community things I’ve been doing these days. Never enough hours in the day (he says, while writing a hobby blog in the middle of the night).

4 Simple & Useful OSINT Search Bookmarklets

Welcome to the 18th most interesting OSINT blog about bookmarkets of 2021. A very quick DIY “tool” share here, guaranteed* to contain at least 40% less of my stupid metaphors & 20 year old pop culture references.
(*not guaranteed)

Unless you’re brand new to the world of Open Source Intelligence (and if you are, welcome!), you’ve probably noticed that one very trendy topic lately has been creating and using bookmarklets to speed up your searches! I’ve posted a few things this year highlighting the fantastic work of Sinwindie, Jake Creps, & Chris Poulter who deserve plenty of credit for fueling the trend, as well as inspiring me to create a few that I use regularly in my investigations. (Jake & Bosintblanc also have a GitHub repo of some great ones, as does Sin

If you’d like a more technical understanding of how these are made, I suggest you check out their work, which I’ll link at the end. If you just want copy and paste instructions to make a few for yourself, well then you came to the right link!
If you’re already groaning with annoyance because “bookmarklets are sooooo 2020, Griffin”, well then I encourage you to skip right to the part where I give you the code for a few of my faves.

Bookmarklets are like Hansel from Zoolander, but actually really, really, really ridiculously good-looking… unlike Owen Wilson.

If you find yourself running to the same sites over and over to conduct searches, you may be able to automate that process by way of bookmarklet. So how does it work? What manner of sorcery is this?

Very briefly and non-technically… we’re using a bit of javascript to automate searches on various sites by recreating the search URL for each site with our search term in it, and opening all those searches in separate tabs at the push of a button.

Depending on your background, a bunch of you probably had one of these two reactions to reading the word “javascript”:

Either…

“Oh god, javascript?? You mean the Dane Cook of programming languages??”


Or…


“The coffee icon thing? I always wondered what that did”.

Well, either way, you’re in luck, because like I said, I’m not actually going to tell you how to write them.
Let’s be honest here, no one actually reads blogs, everyone just skips to the links & tools to check them out, and MAYBE clicks that little star button to send it off to the great bookmark junkyard in the sky. You probably didn’t even read that sentence. Most likely, I’m talking to myself right now.
Like I said earlier, I’ll link the resources at the end that I referenced while learning how to make these.

If you are still reading, 2 notes of warning… sites that do not allow you to visit them while on a VPN will still operate that way when you’re searching via bookmarklet, and if you have a pop up blocker, you’re going to have to allow pop ups from whatever website you have open when you click the bookmarklet link because they pop up a window for you to type your search terms in.

Ok so here’s what you need to do to make the 4 examples below…

Open up a bookmarklet maker site (preferably one that does not capture and store the information you put in), I like one recommended by Jake: https://mrcoles.com/bookmarklet/

Copy and paste the below “minified” javascripts (for more on that, refer to the guides at the end) into the box.
In the name box type whatever name you’d like your link to have (examples provided).
Hit the “convert to bookmarklet” button.
Your screen will look something like this:

Once you’ve created the bookmarklet, you can drag and drop that blue icon right into your own bookmarks bar and you’re all set!
To use it, click on the bookmark link you’ve just created, input your search terms in the box or boxes that pop up, and forget about all the years you wasted doing these searches manually!

this is what it will look like if you’re on Google when you click the bookmark for US PHONE SEARCH

The first bookmarklet is for searching US phone numbers. It pops up 3 windows in succession asking you to input the area code, then prefix, then the last 4 of the number you’re searching. It queries 14 different phone search sites in one click. (some sites default to the search page when no result is found)

Name: US PHONE SEARCH
Script to copy/paste into creator:

var AREACODE=prompt(“Enter 3 DIGIT AREACODE ONLY: “),PREFIX=prompt(“Enter 3 DIGIT PREFIX ONLY: “),LAST4=prompt(“Enter LAST4 ONLY: var AREACODE=prompt(“Enter 3 DIGIT AREACODE ONLY: “),PREFIX=prompt(“Enter 3 DIGIT PREFIX ONLY: “),LAST4=prompt(“Enter LAST4 ONLY: “),TP=”https://www.truepeoplesearch.com/results?phoneno=(“+AREACODE+”)”+PREFIX+”-“+LAST4,FPS=”https://www.fastpeoplesearch.com/”+AREACODE+”-“+PREFIX+”-“+LAST4,NUW=”https://nuwber.com/search/phone?phone=”+AREACODE+PREFIX+LAST4,WHO=”https://www.whoseno.com/US/”+AREACODE+PREFIX+LAST4,PSN=”https://www.peoplesearchnow.com/phone/”+AREACODE+”-“+PREFIX+”-“+LAST4,RN=”https://www.revealname.com/”+AREACODE+”-“+PREFIX+”-“+LAST4,SPF=”https://www.searchpeoplefree.com/phone-lookup/”+AREACODE+”-“+PREFIX+”-“+LAST4,SM=”https://sync.me/search/?number=1″+AREACODE+PREFIX+LAST4,TT=”https://thatsthem.com/phone/”+AREACODE+”-“+PREFIX+”-“+LAST4,SPY=”https://www.spytox.com/reverse-phone-lookup/”+AREACODE+”-“+PREFIX+”-“+LAST4,ADV=”https://www.advancedbackgroundchecks.com/”+AREACODE+”-“+PREFIX+”-“+LAST4,USP=”https://www.usphonebook.com/”+AREACODE+”-“+PREFIX+”-“+LAST4,CBC=”https://www.cyberbackgroundchecks.com/phone/”+AREACODE+”-“+PREFIX+”-“+LAST4;window.open(TP,”_blank”),window.open(FPS,”_blank”),window.open(NUW,”_blank”),window.open(WHO,”_blank”),window.open(PSN,”_blank”),window.open(RN,”_blank”),window.open(SPF,”_blank”),window.open(SM,”_blank”),window.open(TT,”_blank”),window.open(SPY,”_blank”),window.open(ADV,”_blank”),window.open(USP,”_blank”),window.open(CBC,”_blank”);

The next bookmarklet is for searching US name & State. It pops up 3 windows in succession asking you to input the first name, then last name, then a US State you’re searching. It queries 9 different people search sites in one click. 

Name: US NAME & STATE SEARCH
Script to copy/paste into creator:

var FIRSTNAME=prompt(“Enter FIRSTNAME: “),LASTNAME=prompt(“Enter LASTNAME: “),STATE=prompt(“Enter STATE: “),TP=”https://www.truepeoplesearch.com/results?name=”+FIRSTNAME+” “+LASTNAME+”&citystatezip=”+STATE,FPS=”https://www.fastpeoplesearch.com/name/”+FIRSTNAME+”-“+LASTNAME+”_”+STATE,FTN=”https://www.familytreenow.com/search/genealogy/results?first=”+FIRSTNAME+”&last=”+LASTNAME+”&citystatezip=”+STATE,SPF=”https://www.searchpeoplefree.com/find/”+FIRSTNAME+”-“+LASTNAME+”/”+STATE,SPKO=”https://www.spokeo.com/”+FIRSTNAME+”-“+LASTNAME+”/”+STATE,WP=”https://www.whitepages.com/name/”+FIRSTNAME+”-“+LASTNAME+”/”+STATE,TT=”https://thatsthem.com/name/”+FIRSTNAME+”-“+LASTNAME+”/”+STATE,SPY=”https://www.spytox.com/”+FIRSTNAME+”-“+LASTNAME,CBC=”https://www.cyberbackgroundchecks.com/people/”+FIRSTNAME+”-“+LASTNAME+”/”+STATE;window.open(TP,”_blank”),window.open(FPS,”_blank”),window.open(FTN,”_blank”),window.open(SPF,”_blank”),window.open(SPKO,”_blank”),window.open(WP,”_blank”),window.open(TT,”_blank”),window.open(SPY,”_blank”),window.open(CBC,”_blank”);

The next bookmarklet is for searching for the owner of an email. It pops up 1 window asking you to input the email (include the @domain.com portion in your search). It queries 5 different email search sites in one click. 

Name: EMAIL SEARCH
Script to copy/paste into creator:

var EMAIL=prompt(“Enter EMAIL: “),TT=”https://thatsthem.com/email/”+EMAIL,SPY=”https://www.spytox.com/email-search/”+EMAIL,GOOG=”https://www.google.com/search?q=%22″+EMAIL+”%22″,EMREP=”https://emailrep.io/query/”+EMAIL,TRUM=”https://api.trumail.io/v2/lookups/json?email=”+EMAIL;window.open(TT,”_blank”),window.open(SPY,”_blank”),window.open(GOOG,”_blank”),window.open(EMREP,”_blank”),window.open(TRUM,”_blank”);

The last bookmarklet is for searching for domain information. It pops up 1 window asking you to input the domain (do not include the www or https in your search). It queries 10 different domain info search sites in one click. 

Name: DOMAIN SEARCH
Script to copy/paste into creator:

var DOMAIN=prompt(“Enter DOMAIN- no www: “),DBD=”https://domainbigdata.com/”+DOMAIN,WHO=”https://whoisology.com/”+DOMAIN,BW=”https://builtwith.com/”+DOMAIN,SPY=”https://spyse.com/target/domain/”+DOMAIN,DNSL=”https://dnslytics.com/domain/”+DOMAIN,HOST=”https://host.io/”+DOMAIN,DT=”https://whois.domaintools.com/”+DOMAIN,VDNS=”https://viewdns.info/whois/?domain=”+DOMAIN,REVIP=”https://viewdns.info/reverseip/?host=”+DOMAIN+”&t=1″,IPHIS=”https://viewdns.info/iphistory/?domain=”+DOMAIN;window.open(DBD,”_blank”),window.open(WHO,”_blank”),window.open(BW,”_blank”),window.open(SPY,”_blank”),window.open(DNSL,”_blank”),window.open(HOST,”_blank”),window.open(DT,”_blank”),window.open(VDNS,”_blank”),window.open(REVIP,”_blank”),window.open(IPHIS,”_blank”);

Remember, these examples only incorporate sites that generate a unique URL based on your search terms, think: non-influencersoftwitter.com/hatless1der. There are lots of use cases out there, but the important thing is to find what’s relevant to your needs and realize you can make your own!

Bottom line here is that YOU CAN DO THIS.
I managed to follow the instructions and make these myself, and my wife tells me sometimes she wonders how I ever got so far into adulthood while being so completely incapable of listening. At least, I think that’s what she was saying.

If this inspired you with some ideas of your own, then I highly encourage you to go read the guides below and give it a shot. Don’t be intimidated by fancy words and pictures of code, this is not over your head, trust me! No matter what your proficiency level, you can recreate exactly what you see here and go on to make even more. Learn from these folks! Copy this technique! Find ways to automate some work! Save time! Use that saved time to watch Corgi videos on YouTube!

If you’re interested in the how-to, these fine people I mentioned in the beginning have done a great job of outlining it. Here are the links to their how-to guides:
Sinwindie: Pt1: https://www.secjuice.com/osint-bookmarklet-tools &
Pt 2: https://www.secjuice.com/make-your-own-custom-osint-bookmarklet-tools-part-ii/
Jake Creps step-by-step: https://twitter.com/jakecreps/status/1359637077361590279
Chris Poulter at SANS OSINT Summit 2021: https://www.youtube.com/watch?v=KpnVjE8bSvQ