Skip to content

Tag: facebook

A Veteran’s Day Plea: How OSINT Reunited 2 Long-Lost Soldiers.

A Veteran’s Day Plea: How OSINT Reunited 2 Long-Lost Soldiers.

Published by hatless1der on August 3, 2023

The faces and names shown in this blog are real, and are being used with their permission. Some details have been redacted or obscured to protect the privacy of others.

Every Veteran’s Day for nearly a decade, my friend Bill Stevens has attempted to locate and reconnect with a very special Army battle buddy of his from more than 20 years prior. For a number of those years, Bill has aired his pleas publicly via Facebook, accompanied by photos of this bygone era, in hopes that somehow his plea would go viral and word would reach his long-lost friend… but it never did.

Now, I’ve known Bill for a really long time, and for the past several years I have read these increasingly frustrated posts asking for someone to help him. Each year I wondered to myself if I might have any luck, should I try to help with the search. After all, I do find people online for a living, but finding an “Eric Garcia” with a last-known location from more than 20 years ago? Talk about looking for a needle in a stack of needles!

On November 11, 2022, Bill’s plea once again appeared in my Facebook feed. Incidentally, the fall of 2022 was the 5 year anniversary of the death of my best friend and Army veteran, Chad Jolson. Chad and I spent our formative years as 2 inseparable peas in a pod, and the 2 times I’ve cried the hardest in my entire life were the day he left for basic training and the day I eulogized him. I’ve carried this well-worn photo of him in my wallet every single day for nearly a quarter-century, and I still think of him all the time.

Perhaps it was the timing, perhaps just fate, but this time around I decided to reach out to Bill with an offer to have a go at tracking down his long lost friend. I know how close the bonds are that these brave men and women form in our military, and it’s clear that this person meant a great deal to Bill. It’s a total long shot, but if I can somehow help bring them back together, well… I want to try.

I reached out to Bill and asked for anything at all that he could remember that might help me in tracking down “Eric Garcia”, because you just never know when the smallest detail may be of significant importance when it comes to OSINT work. Unfortunately, I was starting out this search with very, very little information:

  • Name: Eric Garcia
  • Location: Ft. Gordon, Ga (1998-99)
  • Prior Location: Colorado
  • Company: Foxtrot 369

That’s it. That’s all we have to work with here.

It would be impossible for me to understate the amount of failure that followed, as I trudged through hours and hours of fruitless searching.

I started out the easy way, asking some friends in the military if some sort of public database exists and got a big fat no. Then I began focusing on Foxtrot 369, scouring military unit pages, Facebook groups, online articles, and anything I could get my hands on. After hours of going this route, nothing had paid off at all.

From there, I went the typical people-search website route, reviewing the contact information of every single “Eric Garcia” I could find with ties to either Ft. Gordon, GA or the State of Colorado who was born in or around 1980. Do you know how many people that is?? Spoiler alert… IT’S A SHIT-TON.

Now, it’s been well documented that I am stubborn at a nearly Olympic-level, but at this point in the process I’m thinking I might actually have to throw in the towel and admit defeat. I’m really not seeing how this is going to be possible with what little I have to work with. Having exhausted pretty much everything I could think of, I’m afraid this one seems to have gotten the best of me.

That pisses me off.

I hate failing, and I REALLY hate quitting. Time to dig deep.

Whenever I get stuck during an investigation, I always take the same approach… I back up and take stock of what I started with, looking for any ways I’ve missed that I can work with whatever information I have available. It occurs to me in that moment that I have one piece of information I’ve not yet explored at all…

The photo itself!

More specifically, the face of “Eric Garcia”. Yes, these photos are old, and yes they are a picture of a picture and not very high quality, but these days there are a number of free, open-source options for doing facial recognition** and also for upscaling low-quality photos. Some of these FR sites target images scraped from one specific platform, while others search their much wider, scraped databases. In rare cases, you can have some sort of success with search engines looking for a face, though they’re not great.
**Before you visit or use any of these sites, please understand the risks, laws, and policies that may govern your access or use of them. I am not your lawyer or your boss! (but go ahead and take tomorrow off)**

I search several of these open-source facial rec options, including search engines, and BOOM… one of them gives me some very promising results!!

Holy shit!!! Is that?

No way!

To my untrained eye, this certainly looks like a promising result, but these days we don’t need to rely upon my useless opinion, we have the benefit of a number of free AI-powered facial comparison tools like Amazon’s “Rekognition“. Let’s see what artificial intelligence says about whether this is a match to the “Eric” we are looking for…

99.8%? Ok then!

After countless frustrating hours, and nearly throwing in the towel on something that I REAALLLLYYYY wanted to solve, I’ve finally got something to work with!

There’s just one problem.

The URLs for the photos are cut off, intentionally. You see, this site is only willing to give me a teaser for free, but they want me to sign up for their service and pay them for the full results. SHIT!

It’s time to do what we do best. Get creative…

The part of the URL I can see tells me the domain begins with “hitched”. Based on the look of these photos, I’m thinking they’re from some kind of formal event… naturally, the kind where people get “hitched”. I suppose it could be that he’s just a very dapper dresser in everyday life, but even I (whose personal style is best described as “middle-aged, nostalgic, Midwestern dad) can tell that these are probably from a wedding and not how people dress in their day to day lives. Although I can’t discount the possibility that he’s gone on to become a famous menswear model, I decide to go with the wedding photo idea first.

I need to find these photos in the wild, but how? Instantly I wonder… could these results have been indexed by a search engine? Without the full website name, do I even have enough to find them?

Using the most fundamental OSINT skill of Google dorking, I craft query after query using the inurl: search operator coupled with the word hitched, and tack on a few potential keywords that I’m hoping might lead me to the site in question. By using this search operator, I’m asking Google to restrict the results to only URLs containing the word I specified (hitched), and combine that with a search for those other keywords I am interested in. These searches would look similar to something like this:

inurl:hitched wedding photography

As I begin to look through the results, I realize it’s inefficient for me to scroll through their entire websites as I find ones I’m interested in. I really need to be thorough here if I’m going to find that needle I’m looking for though! What if I ask Google to do the hard work again for me? Perhaps a dork that directs Google to query just what they have indexed from each of these sites I’m interested in, focusing on the keyword Eric. That would look something like this (for a site called hitched.com which was not the name of the site):

site:hitched.com eric

This is where being absolutely unassuming in your work will sometimes pay off. If you’ve noticed, I have been putting “Eric” in quotes throughout this blog. Did you wonder why?

The reason is that when I research something, I start broad, making the fewest assumptions I can because several times over the years something like this has happened:

While reviewing the Google results for one particular photographer’s site, I noticed something… One of the entries was for Erik + [Bride]

(I’ve removed her name for privacy, and from here on out will just type [Bride])

Could it be? I take a closer look…

Hell. Yeah!

As it turns out… I’d been given an incorrect spelling of the person’s name that I was looking for. It’s Erik, not Eric. How do you like that for an added layer of complexity?

But seriously… Hell. Yeah!

Ok, tv timeout here for a little soapbox moment. Let this be a helpful lesson for those of you crafting really complex Google dorks in order to find precisely what you’re looking for… It’s a double-edged sword at times. When you’re dorking, consider if it’s best to only be as restrictive as you need to be in order to get the result. I could have easily put the name Eric in quotes in my queries, asking Google to return only results with that particular name, however, I may have accidentally missed what I was looking for by having the Erik result filtered out. Google is doing me a favor here with something called “fuzzy searching” where they provide similar results. Annoying at times, but helpful in cases like this!
You can always add on more specificity in your searches as you go, and in this case I only needed to be completely restrictive about the site: portion of my request.

So let’s take stock of what I have so far…

After reviewing the wedding photos, I have the names Erik & [Bride] Garcia, I know what they look like, I know their August 3rd, 2013 wedding was at a well known venue in San Pedro, CA, I know the name of the Los Angeles photography company who did their pictures, aaaaaand… not much else. Do you know how many Erik Garcia and [Bride] Garcias are in and around the Los Angeles, CA area?

You guessed it! A SHIT-TON.

My first instinct was to take a look at the photographer’s social media. Surely, the bride or groom would have liked or followed one of the photographer’s social accounts, right? Wrong. More time wasted.

I wonder to myself if the photographer made a 2013 post touting their beautiful photography and the happy couple. That’s definitely the sort of thing that a bride and groom might like, right? Let’s find that! I hit the photographer’s Facebook, use the timeline filter feature to head back in time to 2013 and just like that, find the post I was hoping for:

Only… they didn’t like it. Or comment. Neither did their friends. Damn!

At this point in the story I’m back to doing a lot of spinning my wheels. A lot. I’m looking at online reviews of the photography business, the wedding venue, looking at social media pages, scouring posts and comments and shares. I’m grasping and grasping and grasping and nothing I’m trying is paying off.

Remember what to do when you get stuck?

Back up.

So I go back to the photographer’s post above and ask myself what else do I possibly have to work with? What is pivotable? What is unique? What have I overlooked? And then I see it…

#TheSepulvedaHome

The venue has a hashtag! This opens an entirely new set of doors for me because now I’m hunting the wider social media landscape looking for not necessarily just Erik & [Bride], but rather any of their wedding guests who posted photos using the hashtag #TheSepulvedaHome on August 3rd, 2013. If I can find just one wedding guest, maybe I can back into one of their social media profiles!

So I hit Facebook with a hashtag search, look back to 2013 and find this post…

There it is. Just exactly what I was hoping for! A perfectly preserved memory from just the right date, with just the right hashtag, and a mention of just the right couple. Oh, and several guests tagged as an added bonus. Jackpot!

Sidenote, this ends up being a sort of right place/right time situation in retrospect because doing that hashtag search on Facebook now only gives you a handful of results and no filtering by year options like it once had. If I was doing this research today I would have potentially dead-ended right there. Thanks Facebook, for constantly changing all of your best OSINT-use features! #RIPgraphsearch

Alright, so even looking back on this while I write it I’m still kinda feeling myself, so I’m just going to drop this little meme here:

I mean come on… Backing into an associate using the wedding venue hashtag??? If I live to be 1,000 years old I might never use that one again! But the thought process that caused me to back up, take stock of what I had to work with, and find another angle? Hell, I’ll probably do that again tomorrow, hopefully you will too.

At this point I’m expecting to begin my typical social media exploration research, find accounts for Erik & [Bride}, and leverage them to drum up ways for Bill to make contact. Easy enough, right?

I shouldn’t be surprised that this turned out to be harder than expected as well.

Exploring the profiles of the wedding guests for publicly available information eventually leads me to several wedding photo posts that @ mention an interesting username in the text. A username somewhat similar to the bride’s name, or what could be a nickname. Hmm… These aren’t tags like what you normally see on Facebook where a person’s name is hyperlinked to their profile, instead they probably came from the linked Instagram profile of the wedding guest posted them. This is a feature of these two Meta-owned companies, where you can cross-post content in both places. Since Instagram uses @ mentioned usernames in their posts, I head over there and find [Bride]’s Instagram account using the username mentioned in the Facebook post.

The profile (which is now private), had a great many photos on it from over the years but as I scrolled farther and farther down, something was missing… Erik. Now, I felt pretty confident that I had the right [Bride], she is in the wedding photos after all, but she is using a different last name in her social media and I’m beginning to suspect that perhaps the marriage ended at some point and that’s why I’m not seeing him. Could this end up being a dead end after all?

With this in mind, I go back to posts around the fall of 2013, looking to see if anyone who could be Erik comments or if any friend mentions Erik or tags an account that may no longer be hyperlinked, because that could still be viable for me to explore. Once again, tenacity pays off…

Following the tagged profiles in the comments on this post from just weeks after the wedding I come to tagged Instagram user @h8[redacted]

The profile photo is not great, but it sure looks a lot like the Erik I’m looking for. Now that I know he might be a Journeyman Lineman with Local 47, perhaps I can find other sites with information on him that I can pass along to Bill. Returning to Google for some keyword searches does the trick!

WAIT JUST ONE DAMN MINUTE!

Shaun??? You’ve gotta be kidding me. Not only did I start with an incorrect spelling of Erik’s name, but now it appears this wasn’t even his first name at all? If someone came to me and said hey I’d like you to find this person from 20 years ago, but I’m only going to give you their middle name and last name, and I’m going to spell one of them wrong I’d say…

And yet, lining up the original photo with the wedding photo and the LinkedIn photo, I see the truth, right there on the screen. Bill’s long lost friend “Eric Garcia” is really Shaun Erik Garcia.

I’ve found my needle.

From here I have more than enough to go on, and start hitting the usual people search sites with Erik’s name, age, hometowns, etc. It’s not long before I’ve drummed up a couple email addresses, physical addresses, and phone numbers to try. All of this is packaged up with the social media accounts and sent off to what I can only assume was a completely stunned, and very happy Bill.

Several months after I shared all of this information with Bill, I learned that he had successfully leveraged it to make the long overdue reconnection he’d started seeking so very long ago.

Once again, the power of OSINT saves the day.

I’d like to wrap this up by taking a moment to thank Bill & Erik for letting me tell this story, and also recognize Bill, Erik, Chad, and every single brave and selfless person who has courageously put their own lives on the line for the freedoms we enjoy.

An Overseas Businessman Died and Left Me $4.6M, So I Used OSINT & Social Engineering to Scam a Scammer.

Published by hatless1der on May 18, 2023

I received this email to my business back in 2022, and it landed directly in my spam folder, exactly as it should have…

It’s a scam so old it has become cliché in much of the world. The overseas millionaire, perhaps a Prince, or in this case a rich & dead businessman whose living proxy has miraculously plucked me from the masses of all the email-owning people on earth to be the sole benefactor of an oddly specific fortune! What luck!
I mean, never mind the fact that I can’t even conjure up enough luck to win the monthly business card raffle at my local Subway restaurant, looks like things are finally turning around for me!

You ever wonder who’s on the other side of one of these emails?

Well I did, and although it seemed like an impossible feat at the time, I decided to take a swing at exposing the fraudster on the other end of the line and see what kind of end game they had in mind for me, their hapless and less privileged victim. What resulted was a wild OSINT and social engineering ride I’ll never forget!

To start off, I take a moment to define a goal. While things may change as we move along, at the outset I know that I want to elicit information from the scammer that may help me identify them in real life. Ok great, how do I do that? I need to think of the kinds of people the scammer expects to engage with when he or she is successful. Not very savvy? Perhaps unwise about technology? Maybe greedy? I’ll definitely need to play a role in order to accomplish my goal and I figure the more I act like like what they’ve experienced from prior victims, the more likely it is that I might draw something out of them.

How will this all go? Well I don’t know quite yet.

Although I am almost completely certain that I’m dealing with a freshly created throwaway email address, I can’t just assume they’ve not made some kind of mistake and not do the research on it. So I check all the usual boxes to start: run the email through breach data tools, https://haveibeenpwned.com, https://emailrep.io, Google, check the username portion in https://whatsmyname.app, etc etc etc. If you’ve spent any time doing OSINT work, you know those angles quite well, but if not, I would encourage you to check out my prior blog on pivoting off an email address HERE.

All of that was a bust, as expected. Now I know I’m going to need to start the active engagement at this point, so I fire up the VM, open a sock-puppet Gmail, and get to work. I’m not going to email them back from my work account and expose anything about me so this will be done under my favorite alias. (Bonus points to anyone who recognizes where the name Tommy Gemcity comes from) Hint: It may be spelled differently than the actual origin.

So I’m basically cold-emailing them from a new account they’ve never seen before, but given the fact that I’m sure they spammed countless email addresses in their quest for a victim, I doubted they’d notice at all. I was right. You might also notice my email signature where I’m actually taking a stab at (harmlessly) phishing them right back. The Treasure Hunter’s Club? Does that sound interesting enough to click on the link in my signature? If it did, their IP address would be instantaneously captured before they were redirected to a completely normal and harmless website I’ve pre-programmed to be the final destination. How you might ask? There are a number of sites and tools who shall remain nameless, that can help you set something like this up and may even let you choose from some pre-made URLs or use a link shortener to help make your IP-grabbing link look just a little bit more legit. (Blah, blah, don’t break laws, blah, blah, don’t violate policy, blah.

Now I will admit I started out a bit greedy here, and at this early stage of the game, our adversary was too wise to click on my tricky signature link. Let’s carry on.

A few days pass, and I receive a reply with good news! All they need in order to transfer my millions is: my full name, my address, my phone number, and a copy of my passport or ID. AMAZING!
Suddenly though, I get cold feet. You see, I’m a little leery about giving out my information online. Or so I say…

I’m hoping that my need for reassurance will result in the scammer giving me something I can work with. Let’s see what they come back with…

BRILLIANT! Turns out they had some concerns about me as well, but I’ve now proven myself the worthy recipient of this “legal and risk free” fortune, which is coincidentally my favorite kind of fortune! Let’s have a look at these OFFICIAL documents:

Now I’m no bank fraud investigator but I could tell these documents were authentic right when I noticed they used at least 6 different kinds of fonts. And while I’ve never actually seen what kind of paperwork you have to do when you drop that kind of coin in the bank, I definitely image there being lots of stamps and signatures, so check and check! Looking good to me! [rolls eyes]

The scammers are still waiting for my personal information, so I oblige, providing them with the address and phone number for the largest apartment complex in the United States and of course a link that will take them directly to the web page of Google files, while conveniently grabbing whatever IP address they might be using at the time. Yes, I’m trying that trick again. What have I got to lose?

I’m really starting to wonder though… what is their end game here? It can’t be just simple identity theft, can it? Perhaps more will reveal itself as we carry on.

As you can see, I’m being passed off to a new and much more official sounding email address. I will fast forward over this part of the story because it involves multiple email exchanges with them assuring me they are ready to transfer the money but need my ID photo, and me fumbling through various reasons why I can’t manage to attach a simple JPG to my email, trying to keep them on the line to expose something useful.

But in the meantime, something amazing happened… they clicked the link!

I’ve got an IP address to work with! Of course, I’m not holding my breath that this is going to be someone’s actual IP and not one of the zillions of easily accessible VPN IPs available to literally anyone with even the slightest ability to Google, but I’m still going to check…

I see that the Internet Service Provider (ISP) is Orange, from the Ivory Coast area in Africa, and I check it in several tools like https://maxmind.com, https://ipinfo.io, and https://dnslytics.com to see what they can tell me. All say Orange is the ISP, general area is Abidjan in Cote D’Ivoire, and now I’m seeing it’s negative for VPN/proxy/TOR/relay. This is looking really promising!

One other thing I like to look at for someone’s IP is a site called https://iknowwhatyoudownload.com, which checks for torrent download and distributions. In many parts of the world, this is still popular and while it might not offer me any value in terms of identifying someone, I can use this to get a sense of whether an IP might be from a VPN or not by looking at the volume. Many VPN IPs, when checked through this site, will reveal a very long list of torrents (often X-rated), that would be more than a typical household would consume on its own. In this case, the IP in question had just a handful of results for some TV shows, not what I would expect from a commercial VPN IP.

You might be saying to yourself, “all of this is great, Griffin, but it’s not getting us any closer to identifying someone!” You’d be right. Without a legal order or some kind of special access, finding the person behind that IP isn’t going to happen. Or is it?

You see, we have one hail mary left to throw here, and its our good old friend breach data. I call it a hail mary because it has only worked for me a handful of times over the years with IPs due to a number of factors around how they can be changed as well as the move to IPv6 from IPv4, but it’s still something worth checking. As it turns out, this IP address HAD been part of a data breach, and it was connected to someone’s account. Someone we’ll call “PB” from here on out.

This is (potentially) great news! I say potentially because there are a ton of asterisks that should accompany information like this. For one, it does not put this person behind the keyboard in my situation. For another, we do not know if this IP address from the breach is still with this person. The list goes on, but for the moment we’re going to call “PB” a person of interest and see where things go.

Now we get to the fun part, OSINT! We’re working with an email and a name, and we want to see who this person is, what they’re about, and where they are in the world.

Finding a foothold in this person’s online life was a challenge at first, because they do not go by their (presumed real) “PB” name in social media handles, they go by a version of what I will call “Bright Man”. Here’s a little tip for you… I was able to locate a Facebook profile for this person by letting Google do the work for me, creating a Google dork to view results indexed from Facebook specifically that included parts of the “PB” name in the URL. Something along the lines of site:facebook.com "TERM1 AND TERM2". You see, a lot of Facebook users may start out an account using their full name, and then adjust the display name to something new like Mr Bright Man did, but they never change the URL (yes that’s a feature). So when John Smith starts a Facebook account at facebook.com/john.smith and then changes his display name to Jethro Gibbs, well his URL will remain unchanged. I can’t even count the number of times I’ve found someone’s Facebook account by just trying firstname.lastname in the URL, try it out sometime!

OK, so Mr. Bright Man is merely a person of interest here, and may very well be unrelated to the scam so I’m going to blur him out, but I will say he had quite the online presence to explore:

I was also able to gather up several phone numbers and email addresses from clues left in his online posts and videos, as well as determine roughly where he lives by geolocating a few of his YouTube videos. So now I’ve got a decent handle on who this person of interest is, should that become helpful down the road.

All the while I’m researching Mr. Bright Man there’s still one question burning in my brain… what is the scammer’s end game? Obviously, scams are for money, but so far the worst thing they’ve tried to do is get a copy of my passport, address, and phone number. Could they monetize that? Sure. Is it more work than just getting me to send them money somehow? Yup.

And just then, the answer finally arrives in my inbox. It’s a bit small to read in the picture below, so let me just spoil the surprise for you now… it’s an advance fee scam. I’m being advised that the account holding my $4.6M is a “suspense account” which requires reactivation by way of paying a fee before they are able to release the full funds. I am offered two options: 1 reactivate the account and claim the very substantial interest accrued for the fee of $1260, OR reactivate the account and forego the accrued interest for a smaller fee of $860. Classic!

What kind of a money-hating idiot would turn down hundreds of thousands of dollars in accrued interest just to save $400 on fees? NOT THIS SOON-TO-BE MILLIONAIRE!! Sign me up for that $1260 fee right away please and thank you very much!

Is this the end then? That’s really all there was? Well, no. I’m not ready for this to be over. Much like Ted Lasso, I know the end will come eventually, but I won’t let myself think about it being over until the last possible moment. Goldfish memory!

I’m going to take one more stab at getting information from the scammers and see where it leads. If I assess what’s happened, I know they want me to send them money, I know they must have a way to get that money, and I know that their banking information may reveal new clues for me, so I press on. I’m ready to send the money, just tell me where…

Ah crap! Thomas Smith??? That just screams obviously fake.

But wait.

Aren’t they expecting me to send them money to this account? So that means they intend to get it. There must be more to this that what I though. Maybe Thomas Smith is actually a real person. Maybe Thomas Smith is a victim as well! You see, there’s this thing called a money mule, essentially a middle person usually uninvolved in the actual scam who facilitates movement of the funds involved. In some cases they are tricked, in some cases coerced, and in other cases they may actually get a cut of the money for performing services like cashing out and sending the balance elsewhere. (Work from home job scams anyone?)

I need a plan. Finding a Thomas Smith somewhere in the world is going to be impossible without some other kind of information, so I play the helpless, bumbling victim angle in hopes of gaining something I can use. I tell the scammer that my bank won’t allow me to transfer the money despite my best efforts, but let them know that I do have access to PayPal and Venmo instead if only they’d be willing to provide an email address or phone number for me to look up their account. But will they fall for it?

More has been revealed! Let’s get to work on finding Mr. Smith, and seeing what he’s all about. First, we check the PayPal profile using the search by email feature of the mobile app and see what appears.

A face! It’s a start, and we still have the email. If you’ve read any of my other blogs, you know how much I love the https://epieos.com tool for researching email accounts. In this case, I find that the email is connected to a Google account for Thomas, and that Thomas has left a number of reviews of businesses in a fairly tight geographic area.

Using Thomas’ very common name, and some of the names of towns near the area where he left those restaurant reviews, I start hitting the Facebook advance search feature. Combining his name with various town names, it doesn’t take me long to find an account with a face that looks remarkably similar to the PayPal I was referred to by the scammer.

Success!! As I look more into Thomas’ life, I realize that he’s most certainly not someone wrapped up in an international wire fraud scheme, he’s most likely an innocent victim himself, either being preyed upon or compromised in some way. I’d like to see if I can locate his contact information or residence now, because I have every intention of passing him off to local authorities who can help him. I return to his online life in order to gather more information. Part of what I do is read the many different business reviews Thomas has written looking for clues, and I discover one for a church. This particular review leads me to believe that Thomas is very active at this church and I wonder if their social media may have other photos or information about him.

Bingo! I read on and find other posts mentioning him, explaining his background, and listing his family members including his wife by name. This is more than enough information for me to hit some people search sites like https://truepeoplesearch.com and begin researching the addresses. I locate an address that appears to be current, but just to be extra sure I Google for the County GIS portal in order to research property tax information on the property address. You’d be surprised how many US Counties have these kinds of sites and searches available.

Just the thing I was hoping for. Thomas and his wife are both still listed on the property, and through the people search sites I was able to gather information for them as well as locate additional social media. More than enough information for someone to make contact with Thomas and help him out of the situation he may stuck in. Elder scams are sadly quite prevalent, and often extremely detrimental to their victims who can unwittingly lose large sums of money in a short period of time before even realizing something is not right. My hope for a happy ending here is that someone can help Thomas, and I know just the folks to do it.

My findings get packaged up into a report, and despite the fact that I never actually proved that Bright Man was behind the scam, I provided more than enough information to the authorities to demonstrate what was occurring and compel them to at least help Thomas. This was all delivered to a friend at a US agency who deals specifically with these types of crimes and who happened to have a fellow agent and friend right in Thomas’ area that would follow up.

Wow, what a journey that was! By playing the part of a clueless victim, I was able to take a run of the mill scam email, elicit potentially identifiable information from a person or persons halfway around the world, and by utilizing OSINT I was able to put together a significant amount of intelligence on a person of interest, and most importantly identify and lead authorities to a likely victim who may have really needed help. I’d say all in all that’s a pretty impressive result!

Thanks for sticking with me till the end. I hope you enjoyed the story, maybe picked up a few things, and most importantly became just a little more aware of the dangers lurking out there online.

My 3 Favorite Facebook OSINT Tips & Tricks

Published by hatless1der on January 5, 2021

You’d be hard pressed to find an information rich source as robust as Facebook. With over 2.7 Billion active users (including my own grandma), it has to be a first stop for anyone conducting online research. There has been much written about gathering information from Facebook, and it remains one of the more popular OSINT subjects, which will likely continue until the simply misunderstood Google + makes its triumphant return to glory and… oh hell, nevermind. Let’s move on.

In trying to prepare for this, I spent many hours sketching out thoughts on my favorite tips and tricks for blue big brother, and eventually it became apparent that unless I wanted to write a book instead of a blog, this needs to be whittled down. Perhaps it’ll end up being a series of blogs one day. And perhaps I’ll print them all off, bind them, and make a cover page sporting a wind-blown, bare-chested, golden-haired super hunk, perched atop the rocks on a beach at sunset. (age check: If you’re super confused about what you just read, and you didn’t know that was a reference to Fabio, or if you thought of Fabio, but only know him as the guy in the butter commercials… you are too young to be reading this blog.)
Turns out it’s basically impossible to find a royalty-free image of Fabio online, and I’m not much for getting sued, but whoever this guy is, he doesn’t mind standing in for free. Besides, after a few beers, you can hardly tell the difference anyway.

https://www.freeimages.com/photographer/sagas-52953

So, this write-up is for my 3 favorite Facebook tips & tricks that I think everyone investigating online should know. One is technical, one is a URL, and one requires a little intuitive thought, which of course you have a truckload of. A preface… the thing you’ll never see from me is trying to take credit where it’s not due. I view my role here in large part as being someone who shares what knowledge I have gained through some trial & error, but mostly research, in a semi-relatable and poorly-written way. Regarding these tips, I can only take credit for teaching myself one of them, and while the other 2 have appeared in print all over the place, my earliest learning of them came from Michael Bazzell. Bazzell just released the 8th Edition of his book, and while tons of incredible free information exists online from stellar sites and collectives (like my favorite, the OSINT Curious Project), as far as books go, it has become widely regarded as the OSINT bible. Anyway, off we go…

The first tip is a URL you’ll want to have handy, so you can easily edit it with your target profile IDs and go:

https://www.facebook.com/browse/mutual_friends/?uid=1&node=2

This is known as the “mutual friends search” where the numbers 1 and 2 are to be replaced with profile user IDs. Basically, you’re asking Facebook to provide you a list of all friends common to 2 different accounts. The real beauty of this search is that it can work even when one of the profiles has their friends list set to private. 

Finding a facebook profile ID is as simple as right clicking on the profile’s page, selecting view page source, then pressing Ctrl + F and searching for “userID” without the quotes. The ID number will follow, looking like this:

Let’s talk about that for a minute…
Say you’re conducting online research and having a hard time finding your target profile. Being the top flight investigator you are, you begin searching for people in their close orbit based on information you’ve gathered from other online sources. Perhaps relatives, close friends, members of a similar social/interest group, friends/followers from a different social platform, co-horts from arrest records, a significant other from a baby registry, etc etc. If you manage to find some of what I call “orbit profiles” (people you know will most likely be connected to your target if your target actually has an account), but you’re not finding your target, perhaps the mutual friends search is in order! To put it another way, if your yet-unlocated target profile is Martin Robinson, Sesame Street Puppeteer, and you don’t know that he goes by the vanity name Young Snuffleupagus, you need some help. If Martin’s adorable grandma is on facebook, but has 1,000 friends, manual review is out of the question, ain’t nobody got time for that! What if you asked Facebook for mutual friends of nana and Martin’s wife, Annie? Suddenly, you’ve only got 50 people to review and ol’ Snuffy is bound to be one of them!
This trick also works well if you’re trying to develop a list of friend connections for a locked-down profile. Take your locked down profile, and run a mutual friends search with anyone who liked or commented on anything of your target and gather up those lists via a scraping tool, add them all together and boom… you’ve got a pretty decent list of people who are friends with your target!

https://pixabay.com/photos/universal-studios-singapore-2413365/

****EDIT**** in the Spring of 2021, Facebook killed off the following “page role trick” so it no longer works for searching an email address. Leaving this here for posterity, and to remind myself of how great life was “back in the day”.

Next up is a somewhat technical tip, again something I learned years ago from Bazzell’s book (actually, I think I might have read about it on the now-defunct forums on his website but my dusty old brain can only remember like 3 or 4 things, and 2 of them are the names of cereals I like). Big props to the ever-generous Technisette, who helped me trouble-shoot an issue with this trick and uncover an exception I’ll point out in the write up.
(Also, quick shout out to the HowToFind Bot, which also sent this tip out on Telegram recently, they put out some really great stuff and are worth a follow!)

This one is called the page role trick, and it’s the only known way to still search for Facebook accounts by email. As we’ve discussed in blogs past, much like my dream of being a catalog writer for J. Peterman, Facebook destroyed many of my other important dreams by killing its best OSINT features over the years #RIPgraphsearch. One that survived, albeit in a slightly different fashion is the ability to look up accounts by way of a linked email address.

Here’s a quick explanation of how it works… Basically, you create a new “page” using your covert profile, act like you’re trying to add someone as an admin for that page, open the developer tools, and use Facebook’s predictive analytics against it to reveal whose account is attached to the email address you have. If it works, you grab the userID, slap it on the end of a facebook.com/ URL and off you go! Here’s what it looks like…

First, click on the + in the upper right hand corner of your profile and create a new page:

Add in some info to the boxes on the left and hit save:

Once your page is live, go to settings at the bottom left:

Within the settings menu select Page Roles:

Type the email you’re looking for in the page role box.

When you type the last letter of the full email address, if it’s tied to an account, that account will autopopulate as an option just below the box and you’re in business! If it doesn’t tie, or if the account’s privacy settings prevent it (thanks again Technisette for figuring that headache out), you will not see a result below the box and it’s time to move on.
If you’ve got a match, you’ll be able to see the user name as well as the profile photo. Handy indeed, but we want to take it a step further, especially if that user name is as common as people (asshole scammers) calling me about my vehicle’s warranty.
Open the developer tools for your browser (F12 in Chrome & Firefox) and select the network tab, then the search icon:

In the search box type: ANYONE_EXCEPT_VERIFIED_ACCOUNT and hit enter to filter the information to a more manageable list.

Scroll to the bottom of the list in the search box and expand that entry by clicking the little arrow to the left, then click on the URL line which appears below. Make sure “Preview” is selected from the header in the details box as shown below:

There you’ll see the ID alongside the name. You simply take the user ID and place it after www.facebook.com/ to see the account!

You’d type the result like this: https://www.facebook.com/10002677560191

The 3rd and final tip I have for you is using the new search option on profile pages in the most recent Facebook UI. Not every page will have this option, but if they do, it will look like a magnifying glass either in the area just below the profile photo, or it could be in the 3 dots to the right of that header. 

This is something I stumbled across back early last year and wrote a much more comprehensive blog post about, (which I’m sure everyone has already read, bookmarked, printed off, tweeted about, and saved), but just in case… you can read here.
In essence, the search option on a profile page allows you to bring up posts, photos, comments, etc from a profile page which contain keywords or fuzzy search variations of those. For example, searching for the word mother will also bring up results for mom. The best part of this trick is that it will also search tagged posts & photos of that profile, as long as the post by their friend was set to public, even if they aren’t visible on the target profile’s timeline as you scroll the page! That’s a big win for your OSINT investigation. 
I discovered this while looking at a profile of someone who I knew was a Sr, and had a son by the same name. I wondered if searching Sr’s wall for their first name might provide some results. As I learned, searching first name, last name, or a combination of the two provided me all kinds of things I hadn’t previously found while scrolling the page!
Here’s an example of what that looks like, but I encourage you to revisit my old blog post for a detailed read.

The profile here is locked down, nothing visible on the wall:

When I search their wall for their first name, suddenly I get results! These are posts/photos that tagged the target profile, and are set to public for the original poster, but were hidden by the target on their own timeline.

This tip can open so many doors for you in your research. If you know family member names, search them to find pivot points. If you’re trying to validate whether you’re on the right profile, try searching for things you know about your target: their job name, their school name, the word birthday, the word kids (that’s where the closes friends/family members will be commenting), and on and on.

The possibilities are practically endless!

https://www.freeimages.com/photo/baby-boom-1240639

That’s it! My top 3 favorite FB investigative tricks. I hope you enjoyed the ride as always, and thank you to everyone who writes me and says they learned something or enjoyed something here. I have almost enough casual fans to start a bowling team, which is pretty good ROI for all the nights spent hacking out this content. I wish I had time to do more, but it turns out writing a mediocre and unpopular blog about a niche subject does not pay the bills, but it sure is fun!

Think Private Facebook Profiles Pages Are A Dead End? Think Again!

Published by hatless1der on August 13, 2020

As the old saying goes… Facebook giveth, and Facebook taketh away (RIP graph search #neverforget).

Well, in late 2019, Facebook did a little bit (a lotta bit, actually) of both, with their facelift and feature overhaul, creating “new Facebook”. Different search options, new buttons, and an all-around different feel, sent many of us change-resistant folk into angry fits. After all, we’ve been betrayed before! Is this the Decline of Facebook Civilization part 2? (obscure 80s hair-metal movie reference)

If you’re using “new Facebook” perhaps not…

Let’s say you’ve finally arrived, after much strategic pivoting and searching, at your target’s personal profile page. Sweet success! You click excitedly and reach for the champagne as the page loads, but just as you’re about to get your Dom Perignon buzz on, you see it… their wall is blank. No photos, no posts, nothing but a single profile photo set atop a banner with empty boxes underneath. An investigative slap in the face for sure, especially when you’d been expecting to find troves of delightful SOCMINT goodness. How could this be? You had plans! You had dreams!

Now, before you pack up your investigative bags and head for Instagram, I have a little something you might want to see. “New” Facebook added a handy little feature that just might open some doors you weren’t expecting, doors that might remind you of the glorious graph search of old (seriously, #neverforget). That little search button on side of the profile page? It’s not just for what you can see. Here, let me show you…

Notice the profile page is of no use to us at all. Locked down… No photos, no friends, nothing. (profile photo and banner photo are redacted). Well… why don’t we click on that search button and type in the profile owner’s first name as it appears on the page:

BOOM! Suddenly, we’ve got something to look at besides an empty wall! Not only do we get several new photos of our target, but we’ve also acquired new pivot points, namely an account we’ll refer to as “A” who posted “family photos on a beautiful day”. But we’re not done yet…
Let’s try searching for the full first and last name as it appears on the profile:

Different photos! Not only that, but we have a potential fiancée’s name thanks to the photographer’s captions, and since the posts are several years old, let’s suppose they might have tied the knot and now we have the name of this person’s potential wife. Another pivot point!

A quick search for just the target profile’s last name by itself yields yet another unique photo and a business check in:

Now, before we get too far along with searches on our target profile, let’s pivot to the “A” account page on a new tab, and try searching there for our target’s first name:

You guessed it, more photos! Not only that, we see our target is being called Uncle, and his fiancée is being called Aunt. From there, we can surmise the marriage likely took place, and we now have a spouse, and another source of potential intel to work from.
Moving back to our target’s profile page, there are a number of other things worth searching that may yield even more new results. How about searching happy birthday?

Just like that, we have a potential birth date for our target profile owner, and the name of a brother, along with a (redacted) photo of both.

From this point we can go on and on, but I think you get the idea. Pivot to the other profile pages, search their walls for the target profile’s name, find more photos, find more names, search those names on the wall, and continue to expand this person’s network. The possibilities are limited only by your imagination. (and Facebook’s AI, but who understands that stuff anyway?) What about searching words like: mother, father, family, Christmas, Thanksgiving, work, love…?

Remember a few minutes ago when we were frustrated and ready to walk away from this account, and mark it as stone cold? Instead, we used this handy little trick and in just a few minutes, we’ve developed photos, a birthday, a spouse, a brother, some associates, and several other places to look for even more information. It went from a dead end to a small gold mine in just a matter of minutes because we knew where to look!

Next time you find yourself arriving at a target profile page, give this trick a try.  
Even those pages which are already more open will still yield information you didn’t expect, or would have had to dig, and dig, and dig to find. Let Facebook’s AI turn your searches to intelligence and click that button! We’ll call it graph search junior, for as long as it lasts.