Deanon open source tools

In the first years, my sexy classmate Disa was busy picking up new girls on the stream, finding their Vkontakte accounts and determining all their interests. A popular practice already in those days, judging by my surveys. Fun and fervent: VK was several years old, few people thought about privacy on the Internet at all, but easily obtained personal information allowed to do anything with a person. Or, fortunately, not to mess up. Today, deanonymizing data on the Internet is merging even more, often surprising even the pundits of our time. You can even find people on the Internet who don't use it - your parents, for example. Today we are talking about deanonymization and your favorite "computation by ip".

Social networks don't just know everything about you, they can even know what you don't fully understand. As in the story with the pregnant schoolgirl. Try to dig deeper into the ad targeting on Facebook - you will be surprised at what non-obvious parameters can be used to sell ads. From my experience: showing a banner "to two close people temporarily separated by a distance" and searching for "people who donate a lot to mobile games for iOS ".
V social networks you can close or retire, but it’s hardly possible from government databases. On the one hand, it is convenient: a confident PC user - Lyudmila Mikhailovna from the housing department, now does not ask you to bring spattered receipts from mailbox- it has a "City" system. You can check your taxes, fines and debts by going to the website of the corresponding service, and modern banks have even learned to do all this for you (according to at least in Moscow).

On the other hand, the "phone base" on DVD is a hit of sales on Gorbushka at the beginning of the 2000s. Shit from the past, yes, but imagine my surprise when one of the real mobile numbers I was able to penetrate all the data of my car with particular difficulty. By the found VIN-number, I was able to find out the phones, names and regions of residence of the previous owners. By name - accounts in VK, their previous cars and ... in short, we start.
In this post, we'll talk about finding "ordinary" people. Let's analyze the tools for extracting maximum information about a person in open sources of the network, no worse than the old-school "punch by phone". For celebrities, politicians, and popular accounts, the methods may differ, but overlap in many ways.
It's more difficult with examples this time. Despite a dozen successful deanons, I cannot link to any of them without violating the privacy of the participants. You will have to take examples from other sources or experiment on yourself.

Basic clues to search

Personal data

Nickname, name and surname, date of birth, telephone, address, education, service, TIN (SSN), etc. More often than not, only one thing is known, but often this is enough to get you started.

Let's go to Google. Starting point for most investigations. By nickname, Google will give out the accounts of a person in games or on forums, which often reveal other data to us. Steam knows what other nicknames the person is playing under, the forums display the date of birth. Educational institutions often publish student rosters. One "but" - do not rush to immediately trust what you have found. How often do you enter something like 01-02-1983 instead of your date of birth on forums? Here I am too.

Don't forget about search operators... Searching for "filetype: doc" (or xls, pdf) can help if a person has participated in any olympiads or competitions. Educational institutions often publish their results on websites with little regard for privacy. American or Euro students can be found using the "site: .edu" filter, which will search sites in the university zone.

Social search and deep web. Although large search engines have agreed with social networks to index their data, it is often just a first and last name and a couple of lines of biography. Social networks are still practically DeepWeb for researchers, the investigation website FirstDraftNews has written a whole article for foreigners on how to register in VK to make it easier to conduct investigations.

+

Search Facebook , , Twitter Are the main starting points. Their possibilities are enormous: search by fuzzy name, age, school and service.

+

Explanations are superfluous here, the search forms speak for themselves. Filtering by city, age and other data will not be difficult. But there are also some non-obvious things. From what I often use: Facebook allows you to search by phone number, even if the user is not your friend - a new "phone database" from Gorbushka. Twitter will help to find not only the user, but also everyone who replied to him in replies or mentioned him on certain dates. If you still know similar non-obvious features - write in the comments under this paragraph.

Meta search engines and aggregators. In Russia, the most popular is people.yandex.ru, abroad there is PeekYou and analogues that are easy to Google for “people search”. Their bases and opportunities are meager, most often a gentleman's set is a name and a city. But their upside is that they often find linked accounts on other social networks that you might not even know about.

Documents and open data

In addition to the personal footprint on social networks, some data appears on the network without our knowledge. Databases of all ministries, utilities, public services, Rosreestr, registers of legal entities, bailiffs - all this opens additional features for searching. For example, you know that your target is driving a car, doing business or buying an apartment - most likely some information about these operations is readily available on the Internet.

+

This data is not available for search engines, since they require input search query... But these bases are often used by the same FBK Navalny, they conduct many of their investigations through the register of state purchases, the Rosreestr (the last about Medvedev too) and paid service SPARK, recently made famous by the League of Schools.

+

Obviously, there is no single world repository of such data. If you need to find a person outside the Russian Federation, look for the appropriate database. Often times, the availability of personal data in other countries can be surprising. From the experience of my own searches, I can say that in Sweden and some states of the United States there are so-called White Pages, where you can effortlessly break through such terry insider information that this entire post will seem unnecessary. Up to the name of the cat.

+

There is a lot of open data in the USA or Europe, less in Asia and the Middle East. Here are some more aggregators for example.

Skipease- while a live page with a selection of social search engines in the United States. There, on the page, there is a whole list of alternatives, they can help in other countries.

+

Investigative Dashboard Search- search by documents and companies, analogue of Spark for international searches. It works well in Russia, especially if a person is in the top or is engaged in public procurement. This is how you can find out that in 2012 Navalny was a member of Aeroflot's board of directors (but no longer). I didn't know.

+

AVInfo- an open base for cars in Russia and their owners. You can search by license plate, owner's phone number, VIN and get a lot of information about previous owners, carried out MOT, insurance and technical inspections. There are more than 13 million Russian cars in the database, mostly from Moscow and St. Petersburg.

2 comment

It is used to its fullest by auto-pickers, since, among other things, it aggregates and saves ads from the author and droma. For them there is a paid account with advanced features, but for most of our purposes a free one will do. If someone still does not understand what the goals are, then this makes it possible to find out him from the photo of the next "kid next to his four" for one request mobile phone... And if, to celebrate, he also posted on Instagram a photo of the registration certificate or driver's license on his forehead, as is customary upon receipt, then here the deanon can be right up to the home address. This is probably a topic for a separate post.

+

Well, or a more everyday question: find out the phone number of the previous owner of the car in order to politely (!) Ask how long the suspension has been changed. If you have used any other similar services, share your experience in the comments below.

1 a comment

Photo

We looked for places in photography in a previous post, but these tools are often suitable for people too. The view from the window can give coordinates, and a reverse image search can lead to an avatar or an album with user photos. On leprosy or dvach, so they always find all sorts of skins in VK, it's as easy as shelling pears.

+

Searching for people by photograph stands apart here. The first such service was Face.com, it even found inaccurate matches of facial features, but it was quickly bought and closed by Facebook. I will not joke about the Evil Mark again, we were already wearing it in the previous post. For VK last year, FindFace from N-Tech.Lab appeared, doing about the same thing, but under the wrapper of a marketing tool. On its basis, the project of Yegor Tsvetkov from the St. Petersburg "Paper" was especially bombarded, when he took pictures of strangers in the subway and then found their profiles in VK, learning a lot about their lives from one sad photo.

Location

IP address. Although "I will calculate by ip" has become a meme, this method has not become less working. Through the GeoIP2 City database, the country and city where the given IP address is located is well defined. Accuracy to the city is almost guaranteed, in my projects I have been using their base for three years already. Failures happen only in rare cases, when some mobile operator decides to move the pool of IP addresses from one region to another. But this happens once a couple of years and is calmly solved by monthly database updates.

+

GeoIP gives more coordinates, but warns not to use them as the user's location. Most often it is just a point somewhere in the center of a city or a provider's area. But we can try to find a nano-network map of this provider, according to which the search area becomes even larger.

1 a comment

But IP is very easy to spoof, it is never 100% proof. Proxies and VPN tunnels allow anyone to do this with one click. If a person wants to hide the IP, it will not be difficult. GeoIP gives away a different part of the world - most likely it did, but still sometimes it can be a clue.

Other user photos. Got the license - stick them on your forehead and lay them out, let everyone know the series and number. It was already above. Less obvious - photos of receipts from the supermarket, electronic queue coupons or a view from the window. Determining the address down to the floor becomes a matter of technique and desire, if it matters.

+

There is no single piece of advice here. Any information from the photo can become a clue, look carefully at the surroundings.

Geo search. All popular social networks have geotags. Facebook offers to leave "check-in" in various places, Twitter writes your coordinates to each tweet, VK adds a geotag to photos from mobile applications... Sometimes the user does not notice this, and in order to fake them, you need to be able to program. For tweeters, there is GeoSocialFootprint, which analyzes the user's latest geotags. You can try to find similar services for other social networks or sort this data manually.

+

There is also a reverse possibility: search for tweets near specific coordinates. So request

If you have a person's email / nickname and a little free time, you can find his accounts in all social networks and learn a lot about him.

We tested all sites from the article on our author Roman Yuriev and his accounts.

1. Pipl.com

This site is able to search for a person's accounts on different services by name, address Email or phone. It supports Gravatar, Linkedin, Disqus, YouTube, Last.fm, Github, Twitter, Imgur, Kongregate, Hubpages, Slideshare, Pinterest.

And this service checks if accounts with a specific name are busy on different sites. Unlike pipl.com, it also looks for accounts on Foursquare, YouTube, Delicious, Imgur, and WordPress. But, unfortunately, it does not provide direct links to profiles.

3. EmailSherlock

4. PeekYou

Here you need to enter not an email, but a nickname (a postal addresses often contain it). The first of four sites to link to Roman's Instagram and Facebook.

5. PoiskMail.com

This site is not looking for anything, but simply automatically generates links to pages in different social networks with the person's nickname. It will be faster to use it than typing these links manually.

6. Lullar.com

Another link generator. Its list of services is much longer than that of the previous one, and many of them are completely unknown in Russia. But it's worth trying your luck.

7. Search on Facebook

And in conclusion, I would like to remind you of the very easy way find information about a person by email: just type it into a search on Facebook. This is often enough.

The services from the article do the same thing - they look for profiles on social networks. But the places of search are different for everyone. To achieve maximum results, it is better to use them all in combination.

Other articles on the topic of collecting information about people on the Internet.

In e-mail, as a rule, you can find not only personal information - from here hackers can open their way to the rest of the services to which you set a password. And everything is done simply - through password recovery. What are the first steps to take?

We detect someone else's presence in the logs

Haveibeenpwned.com makes it easy to check if your email address pops up during a data breach

You can often find out if strangers have access to your accounts by analyzing account usage statistics (logs), which are kept by everyone. major services... However, such logs are hidden deep in the settings. We'll show you where to look for them using Gmail as an example.

Account login information. When viewing information about visits to your Google Account, pay attention to the device and location information (1). In the settings, you can enable alerts about suspicious activity (2)

In the Google mail service, if you wish, you receive an alert when someone successfully logs into your account from an unfamiliar computer or mobile gadget... To activate the sending of such messages, after entering your credentials, click on your profile and click on the "My Account" button. Here select the section "Actions on the device and notifications" and click on "Manage settings".

Mailbox protection
Many providers have security questions for this purpose. It is worth changing them periodically.

Set the way Google will subsequently share this type of visit information with you. Receiving a notification can signal that someone has tracked down and hacked your account. In this case, go again, as described above, in "Actions on the device and notifications" and click on "View connected devices". You will see a list of all devices from which you logged into Google using your username.

Removing hacker tokens

If in the list Google service an unfamiliar device has appeared, you urgently need to take action - immediately change the password and expel the intruders. Since those, after a successful login, directly connect to the services through the so-called token, a simple password change is not enough.

The point is that a token is an individual access key with which a PC or smartphone is registered in the service. It does not change even when the password is reset and remains in effect until it is deactivated.

To do this, in Gmail again go to your account settings and there click on "Related applications and sites | Application Management ". In the window that opens, you will see all the services and devices connected to the token.

If you are not sure which keys were generated from your computer, delete everything as a precaution. The only drawback: after that, you have to re-authorize in Gmail from all devices.

Photo: manufacturing companies

If, for any reason, the user loses access to his Google account, then he also loses access to all Google services that could be used through this account... Most often, this situation occurs if the user simply forgot his password from the account. In this case, you will have to contact Google Account Recovery. Here you can find instructions on how to restore your access to your account.

When creating an account, the account is automatically linked to the specified number. Up to 10 accounts can be linked to one phone number. If the account was created earlier, then it is likely that you did not link it to a phone number. In this case, you will not be able to restore access by phone, and then you will have to answer several questions to determine whether you really are the owner of this account. If this is confirmed, you will be able to reset your password.

To save yourself from this situation, when registering an account, you must enter your real data in the contact data line, which cannot be forgotten. It will be much more convenient for you later if you enter your own name. For the same purposes, it is imperative to enter an additional e-mail address. This will make it easier for Google and yourself to restore your account.

Restoring access to an account if it has been deleted

Accounts marked for deletion Google not stored for long. The exact time during which the account can still be restored is not known. Therefore, the faster you act, the better your chances of recovery. You can quickly restore your account through your phone, but this is only possible if it is already linked.

So, how to recover your account if you have forgotten both the username and the password. Go to the "" page and click on the "I forgot my password" button.

Next, you should enter the remote mailbox address: now click the "Continue" button.

You will be redirected to a page where you should select where the confirmation code will be sent. Now click the Continue button.

A verification code should come to your phone, which you enter in a special field and thus send a password recovery request.

Now you are on the page where the link to the restore request is active. Click this link. If there is no link on the page, then you simply did not have time and your account has already been deleted. If all goes well, follow the next steps to verify your account. You need to come up with New Password, then confirm it.

If you did not provide personal data for recovery

But what if you need to change your password, and you have not yet attached either a phone number or an additional e-mail to your account? Do it this way. Go to the Google page "", click the "I forgot my password" button.

Then click “Don't know”.

In this case, you will need to answer questions confirming your identity in order to prove that this account belongs to you. Remember the last date you signed in to your account, at least approximately the date it was created, as well as the names of the shortcuts and email addresses that you have used frequently. To keep you as safe as possible from hacking, Google asks tough questions. The main thing is that you answer them as accurately as possible. If your memory lets you down, try at least to guess the most approximate answer - it won't get any worse. Try to log into Google from the computer on which you most often logged into your account.

Then Google will evaluate your answers and offer or change your password or send you an email in 24 hours to contact you. Then you will need to read this letter and act according to the recommendations. It is possible that Google will tell you that you failed to prove that the account belonged to you. There is nothing you can do about it.

As you yourself have seen, Google has made all user steps as easy as possible in order to simplify account management. You just need to follow the recovery instructions. In any case, it is better to carefully check all your settings and enter your data in your account information, link phone number and enter additional email. In this case, no matter what happens, you can restore access to your account in a matter of seconds. At any time you can contact the support system with questions.

I'll show you how to check your Google account for security. This will help you find out which applications have access to your Google account and you can see where and when your account was used.

Go to myaccount.google.com and click on the security check to better protect your account, check its activities and security settings.

After proceeding with the security check, you will see your number associated with your Google account and a backup email address. Here you can also change your phone number to your Google account and a backup e-mail. After you have checked or changed everything, click "done".

Now check the list of connected devices. Check out the list of devices connected to your Google Account. Let us know if you find an unfamiliar device and we can help protect your data. This will display your device on which you are currently viewing this page, and other smartphones, tablets on which you logged into your Google account.

If you find unfamiliar actions here that you did not do, then click "unfamiliar actions", if everything is good, click "everything is in order."

Next, check your account access settings. Browse the list of apps, sites, and devices associated with your Google account... Make sure they are all secure and delete the ones you don't need. This may include your browser, games that record saves or link to your Google + page, email clients and your partner's youtube apps that allow you to view basic information about your account.

If you want to close the application's access to your account, click “delete. Then click "done".

Confirmation method: SMS to your number. Backup methods account login: backup phone number.

Click "done".

Ready. If we notice anything suspicious, we will inform you. You can repeat this check at any time.

• Phone and backup address verified
• List of actions checked
• Device list checked
• Access settings updated
• Gmail settings checked
• Two-factor authentication settings verified

Click "continue".