15 Free OSINT Tools I Used to Find Everything About Me Online
A Guide to Conducting Your Own Digital Footprint Audit
My name and details have been blurred in this write up.
I’ve taken an OSINT (Open Source Intelligence) class once but I’ve never done real-life OSINT on a target person. Since I’m still learning about OPSEC safety and practices, I figured the best target is none other than myself.
Six years ago, I did a simple Google search on myself and was extremely terrified to see how much information about me was accurately and transparently displayed to everyone online. A lot of times, someone could purchase and view my records for less than $1.
I went into a state of paranoia: made my social media accounts private, changed my usernames and display names, and went as far as privating all my posts and pictures on Facebook, which was where I used to post about everything.
Six years later, I was curious to see what an in-depth self-investigation would reveal about me given my new level of awareness and having cleaned up my tracks quite a bit.
tl;dr: I was shocked to see what I could still find on myself. Usernames, passwords, full addresses — you name it.
Capture the Flag
With just my full name, I decided to stalk — I mean audit — myself to see if my digital footprint is the size of Big Foot’s.
These are the flags, or secretly hidden information, that I wanted to see if anyone could find out about me if they had the time. The scariest thing is some of these details are answers to my security questions for banking.
✅: what I could find and was highly accurate
🟡: accurate but incomplete record or requires further verification
❌: could not find any info
Personal details
- ✅ Full legal name & initials
- ✅ Date of birth
- ✅ Gender
- ✅ Ethnicity
Contact details
- ✅ Phone number
- ✅ Email addresses
- ✅ Full current address
- ✅ Address history
Background details
- ✅ Education level
- 🟡 School history: I couldn’t find information on my schools prior to high school
- 🟡 Employer history: I could only find my latest employer
Social details
- ✅ Family connections: parents, siblings, spouse / partner, children, pet, etc.
- ✅ Close friends
- ✅ Classmates / peers
- ✅ Colleagues
- ✅ Mother’s maiden name
- ❌ Nickname
Social media details
- ✅ Usernames
- ✅ Passwords
- ✅ Social media accounts and handles
Legal / official document details
- 🟡 Last 4 digits of my U.S. Social Security number: allegedly breached and in the dark web
- ❌ Individual Taxpayer Identification Number (ITIN)
- ❌ Driver’s license number
- ❌ Passport number
This list already doesn’t include any information that my social connections or I shared in any public social media posts.
Tools
For the purpose of this exercise and with the limitation of time, I stuck with free tools that I could use without installing, creating an account, or paying for any records. There are actually many more tools that I haven’t gotten around to tinkering with, such as AI tools, archives, dark web, etc.
I narrowed down on the list of tools based on my knowledge of which platforms I (actively) exist on. Image searches further verified my assumption that no one stole my identity to create accounts, such as for catfishing.
Get ClearCast’s stories in your inbox
Join Medium for free to get updates from this writer.
Here are the 15 free tools from OSINT Framework that I found worked best:
1. Google Dorks
"Firstname Lastname"
"Firstname Lastname" city
"Firstname Lastname" school
"Firstname Lastname" employer_name
"Firstname Lastname" industry_field
"Firstname Lastname" site:<website.com>With my full name enclosed in quotation marks, Google performs an exact match on those words and in that specific order.
Skimming through 8 pages of results, I quickly see:
- People search engine results: Family Tree Now, WhitePages, Intelius, Anywho, TruthFinder, IDCrawl, etc.
- General location / area
- Gender
- Education: which high school and colleges that I attended, my major, my coursework and projects, my graduation year, my interests
- Social circle: high school and college circle, volunteer experience, extracurriculars
- Social media activity: Facebook, Pinterest, etc.
People Search Engines
I then dug into the people search engine results to pinpoint my exact profile based on my age, address, phone number, email, family members, etc.
2. Spokeo
Spokeo has a free basic search with top-level details like my age, addresses, family, marital status, social profiles, phone, email, court records, etc. that are partially blurred.
3. CyberBackgroundChecks
CyberBackgroundChecks displays unblurred details — phone, full addresses, family, age, etc. — that can be used to cross reference with other people search results.
Data Breaches
With my email, I can then look up my data breaches and find my usernames and even passwords if the previous Google search results didn’t link my social media accounts.
4. haveibeenpwned (HIBP)
haveibeenpwned is a database of breached credentials and email addresses from known data breaches. Fortunately, variations of my main password for important accounts, banking, IRS, etc. had not been compromised.
5. Breach.vip
Breach.vip provide access to 1000+ breach databases for research, email searching, and analysis of compromised credentials. It found my username, passwords, and IP address in data breaches, which I cross-referenced and confirmed with HIBP
Social Media Searches & Username Checkers
With my name, email, phone number, and usernames, I can find more social media accounts.
6. IDCrawl
IDCrawl is a free people search aggregator that finds social media profiles, photos, and public records across major platforms including Instagram, Facebook, and LinkedIn. It found my old social media handles for Twitter, YouTube, LinkedIn, and Quora given just my name.
7. Recover Facebook Account
The official Facebook account recovery endpoint confirms whether an email or phone is linked to account. My email address gave away my Facebook account despite the fact that I changed my display name, username, and URL so that I couldn’t be searchable based on my name.
8. Webmii
Webmii is a good starting point if you don’t have time to do comprehensive Google dorking because it consolidates search results from Google, news, and potential social connections when given a name. It also calculates a web visibility / footprint score based on online presence across social networks, news, and web pages.
9. WhatsMyName
WhatsMyName cross referenced aliases across hundreds of web platforms and found my Duolingo, GitHub, Instagram archives, OpenStreetMap, Snapchat, Spotify, Substack, Poe, and Telegram accounts.
10. Lullar
Lullar automatically generates possible URLs by stuffing the given name, username, or email into the query terms. It was very convenient to see if I forgot about any old social media accounts but it came back with a lot of false positives that could be misleading for a different target person.
11. Epieos Email Tool
Epieos actually found the links to my Gmail calendar and Google Map reviews that I’d forgotten about. Crazy.
Reverse Image Search and AI Generators
With my pictures from social media, such as a profile picture, I can then find other accounts and information by doing a reverse image search.
12. Pimeyes
Pimeyes found pictures of me from some recent sport events that I attended based on my selfies.
13. Lenso.ai
Lenso.ai’s reverse image search identified an old picture of me from the student organization that I was a part of in college based my current Instagram profile picture.
14. FaceCheck.ID
FaceCheck.ID is a facial recognition search engine that found my LinkedIn (always) and Github (sometimes) profiles with high confidence scores of 80–86 / 100 regardless of what selfie I gave it.
15. Face Comparison
Face Comparision takes two images and compares the similarity of the subject in both pictures. It was able to conclude that my LinkedIn picture and selfie(s) are the same (90%) and that my baby pictures are the same (94%).
Findings
From this personal audit, I found that:
- My passwords for throwaway / shopping accounts were leaked.
- Address searches can be used to easily map out family relations.
- A lot of these details, such as address history, mother’s maiden name, etc. are typically answers to knowledge-based security questions.
- My email is linked to my dad’s profile on That’sThem, which finally explains why I get emails addressed to my dad in my inbox.
- There are some accounts that I completely forgot about that needs to be cleaned up or deleted.
Overall, my online presence and risk is pretty low, especially since I’ve privated my social media accounts.
I already knew which information are true so I didn’t have to spend time verifying. If I wasn’t sure about a target person, I would have to use each data point as a pivot point and further factcheck by cross checking with public, official records, such as property records to verify the address.
Next Steps
In my next article, I’ll be sharing how I clean up and reduce my digital footprint.
Subscribe, and I’ll see you next week!
