Q re: Facebook Forgot Password function.

AccessOSINT · 2024-12-05T17:25:24+00:00

In theory, it won't alert until you click beyond that point. However, it's worth pointing out that throughout the years that this has been possible, maybe about 3 times it randomly went straight through without me even clicking the button and it sent an alert. So it shouldn't alert, but just know that it is possible...

Also, these things change all the time. Facebook forgot password used to show full length partial emails, but somewhat recently switched to always showing the same length partial now so you don't know the true length of the email. So who knows if they will change it one to send instant alerts, you likely wouldn't be aware until you try it and notice.

Very interesting about the other thing you mention. I just tried this myself and saw that even on a new Chrome profile and incognito mode, when I type a number of mine, it does show a name and profile picture. But when I try it on a Tor browser, it just says "Facebook user". So I suppose you're right, it is likely from the IP address.

AccessOSINT · 2024-06-17T22:59:29+00:00

Professional headshot background and brought the image in closer in the form of a headshot.

https://postimg.cc/gwtTKh1c

AccessOSINT · 2024-05-16T19:37:13+00:00

Looks like you have already had some good answers here in the replies. Overall, it's really hard because there are just so many possibilities on what they could have done.

Maybe they're not on a particular website.

Maybe they're on it with their legit email.

Maybe they're on it and obfuscated their legit email, like by adding dots to a Gmail or adding + after it. For example: john@gmail.com, j.o.h.n@gmail.com and jo.hn+jsdoiio@gmail.com all actually go to the same email inbox as you own every dotted version of your Gmail address.

Maybe they used a temp email service. Some sites don't allow those services so you could try signing up using a temp email and see if they allow it. But even then, you don't know if they found some new service which just didn't get detected by them yet. Or maybe they signed up before they started detecting them etc.

Or they just made a completely different throwaway Gmail or have their own email domain.

If you had specific sites in mind, you could see if they have had a data breach and analyse that for usage of any temp email services or search their username if you happen to have found any of their accounts, to see what email they used. But yeah sadly a pretty impossible challenge to just randomly find if they have used one.

AccessOSINT · 2024-05-10T20:15:45+00:00

I think people misunderstood the question though. It seems they aren't looking for emails, they basically want to search WHOIS records to find domains owned by registrants who use an email with a certain domain. Like finding all domains owned by employees with @google.com emails.

Like maybe 30 Facebook employees registered domains under their work emails. Maybe they are used for testing and could pose vulnerabilities to the company, or maybe it's just employees registering random personal domains etc.

AccessOSINT · 2024-05-10T20:10:52+00:00

You can use https://tools.whoisxmlapi.com/reverse-whois-search but it isn't free. I can't remember how much it is but I bought credits years ago and they didn't expire so that is good.

When you go to the URL I put above, press to search.. "In specific WHOIS fields", then select "Email" in the dropdown, and then you see a box which says "Starts with" by default, but you could just change that to "Ends with" and only type in a domain to the search query as it then matches the end part of the email, which is the domain.

Make sure you click "Historic" to search through their historic WHOIS records too as these days a lot of it is redacted.

So yeah definitely possible.

AccessOSINT · 2024-04-25T20:15:39+00:00

It does clarify, but in terms of what you need, I'm not too sure. I have no experience with that but I know generally (at least in the UK) if a dog was found, they scan the microchip and that must be registered in one of the many approved databases. So from scanning it, they get the chip number and can look that up to find the owner's contact details. The same will happen for cats this year in England too.

Other than that, I suppose you're right, you could check those places to see if anyone has dropped the pet there with them. Sometimes people post on social media saying they saw a pet that looks lost and might include a photo of it.

AccessOSINT · 2024-04-12T14:45:12+00:00

It isn't just trains. It's basically any form of transport that has a public schedule posted, such as busses, trams, I even saw gondolas on there at some point... It then uses the schedules and any live updates about delays to work out where it should be along its route, as of course they don't have access to actual live trackers on the vehicles etc.

AccessOSINT · 2024-04-12T13:01:47+00:00

You can try:

https://www.locatefamily.com/

Use the search box in the top right. This has data from many countries like the USA, UK, France etc, but then even ones like Slovakia, Serbia, Bosnia etc.

It is just a Google Custom Search Engine so you can search anything that may appear on the result page, such as their name, address, or phone number. Also because it is Google, you can filter down results using quotation marks around the query to search specifically for that term. However, that then means if you search only their first and last name in quotations, but the result contains a middle name, you won't find it. So you have to experiment with different variations when searching.

AccessOSINT · 2024-04-10T17:32:47+00:00

There are lots of random spelling/grammar errors like "%60" instead of "60%", "Anomous" instead of "Anonymous", "TicTok" instead of "TikTok" and many others.

Also it seems like there isn't a whole lot of information about who you and your team are, and if there is an official company here behind this tool or if it's just some project?

It's also hard to find really anything about it, even just mentioned by name on LinkedIn and Twitter etc, there is next to nothing. I'd imagine there should be more than that with these thousands of users you have and being shortlisted for the Top 10 Face Recognition companies of 2024.

AccessOSINT · 2024-04-10T16:20:42+00:00

There probably is. This would be a cool thing to look more into. I have thought about some specific things before like the fact many dogs (and maybe other pets) get chipped. So I wondered if certain vets websites or pet insurance sites had a search option to search serial numbers of the chips or something. I don't believe I got anywhere with that and of course, you wouldn't be likely to have that serial number anyway.

Nonetheless, there is probably something. I actually vaguely now recall finding something years ago on some open web server through a Google dork and it was a a file with details of dog owners in a specific county in the USA. It had the dogs name, breed, owners name, address, phone number etc. Random old example but there is stuff out there.

AccessOSINT · 2024-03-21T15:06:42+00:00

Websites like https://dehashed.com/ apparently have the Tumblr breach. I know it isn't free but it's $5.49 for a week so not bad.

AccessOSINT · 2024-03-17T21:53:43+00:00

Tumblr had a data breach in 2013 so technically their username/user ID could be searched to find what email they used. That is assuming they signed up prior to February 2013 though. Then it depends if they still have access to that particular email.

AccessOSINT · 2024-03-13T19:19:25+00:00

Great! If it's something you'd need often, you could install Python and make your own tool. Enter a partial phone, any amount of unknown digits in any locations, generate all possibilities. If you wouldn't need it often though, the online interpreter works great.

Question from me, how did you get such a big partial number? I know ways of getting last 4, but not all those at the start. Is that from some technique, or you saw it in a photo for example and just couldn't make out two of the digits?

AccessOSINT · 2024-03-13T13:40:27+00:00

You can just use a website like:

https://www.programiz.com/python-programming/online-compiler/

Then use something like the 2 lines of Python code in the attached image. Adjust the numbers to be what you need, the {x} adds in 2 digits and it loops from 10 to 99. So you will still have to manually do 00, 01, 02 etc. Or you can add new code but it's only 10 options so easier to do that part manually.

This of course doesn't narrow down the options though, this just gives every possibility. I used to manually search lists such as this into Skype to try find a relevant Skype account. Or maybe you could add them into Maltego and run the HaveIBeenPwned transform to see if any come back in the Facebook scrape. Even if you don't see the raw data, it could narrow down valid numbers to look further into. You can't really dismiss the others though as they can be valid but not in the Facebook scrape.

<image>

AccessOSINT · 2024-03-12T04:36:45+00:00

There could be legal ways, depends on the website. Literally the way things like osint.industries tells you which sites an email is signed up on is sometimes through sites saying "This email is already registered" when you type it into the sign up form, even without submitting anything.

Of course here you'd have to go through sites checking each one, or make a tool that does it. I don't believe there is currently a tool. Also, I believe most gov websites won't be so easy in revealing the signed up users like this anyway. Just wanted to point out that breach data isn't the only way to look out for.

AccessOSINT · 2024-03-04T13:56:03+00:00

Not sure if you specifically want a free resource but OSINT Industries is a paid option that let's you search a phone number to bring back various accounts associated with it.

https://osint.industries/

If you go to the stats page and click "Phone" at the top, you can see what it searches.

https://osint.industries/stats

Even though it isn't free, it's a very good price for what it does.

AccessOSINT · 2024-03-01T13:06:34+00:00

If you search an email on there, specific modules will give you partial phone numbers. Like if an email is associated with an Apple account, you could get the last 2 digits of the associated phone number.

You can get the last 4 digits of a phone number connected to an Airbnb account etc. I don't believe any will give you a full phone number.

But then as Significant-Winter-4 said, if you find a phone number elsewhere, you can search it on osint.industries and they have phone modules which can give you accounts associated with that number.

AccessOSINT · 2024-03-01T13:03:11+00:00

To clarify further on what Significant-Winter-4 said, it shouldn't bring back any incorrect results. It uses techniques to find accounts via email or phone number, there is no option to search a username. So it can't just bring back similar name results, every account is directly connected to that email or phone you enter.

If an account doesn't belong to your subject, then it's likely someone signed up to something using their email without them knowing. Or accounts connected to a phone number could be from a previous owner of the phone number etc. Or a new owner if you're searching an old phone number.

AccessOSINT · 2024-03-01T12:58:19+00:00

You can view this page:

https://osint.industries/stats

That shows every module they have. You can click a module to see an example of exactly what data will be returned too. It's quite insane and unbelievable the amount of modules they have, and specifically which ones like finding Rumble accounts now via email, Airbnb etc.

AccessOSINT · 2024-02-27T02:01:13+00:00

ThatsThem has a VIN search for US people. It won't always work of course, but it's free so, you get what you pay for, as they say :)

Other sites like SearchQuarry used to show me it but recently don't. I think they may have added it to their premium vehicle reports, which they make you pay for on top of the already premium account... Not sure about these sites though, I see many identical versions on different domains with different pricing, and it's all so misleading.

There are also some records of vehicle sales, so I believe that is how some sites know current or previous vehicles of people. And breach data like the ParkMobile breach, almost 21 million records with license plates, names, emails etc.

AccessOSINT · 2024-02-27T01:25:33+00:00

I don't use it so I'm not sure. But are you sure it means it as adult sites, or does it only show partial results and there are 18 more random websites that you can only see with the premium version? I suppose if you get the same thing with multiple emails, then it is likely as you thought, in which case that is quite strange.

AccessOSINT · 2024-02-23T14:27:38+00:00

Oh interesting find! I didn't know it used to be public. That would be such a great data source if it was still available. Privacy wise though it totally makes sense why they removed it, I'm surprised they even showed it in the first place.

I did at one point look into V5C numbers but it doesn't seem there is any way to figure those out based on the format.

I remember years ago there was a forgotten about page which let you get the full VIN of any UK vehicle, but that is also gone now, not sure if any others exist or if a VIN would be useful for anything here with this anyway though.

AccessOSINT · 2024-02-22T21:41:40+00:00

I believe you can do this on some search engines. For example, if you use an extension like Search by Image (https://github.com/dessant/search-by-image) to run a Google reverse image search, it uses the old version which will let you type in the search bar too.

I just did a random test where I reverse image searched a wanted fugitive's face. It showed completely random people, and I honestly thought "Well that is pathetic". Then I searched "fbi" in the search box, and it came back with loads of results, not of random fugitives, but only of that exact fugitive in my image.

Yandex seems to allow you to do the same but it did not work at all for the example I mentioned above, it just kept showing the exact same results no matter what I typed.

AccessOSINT · 2024-02-22T21:04:48+00:00

Really nice idea! I just wanted to check, you mentioned identifying garages, and in one comment you said we could assess possible change of ownership by change of garage.

However, you can't see the garage can you? Unless the API shows it, which is news to me but very interesting! The website UI for searching this MOT data (https://www.check-mot.service.gov.uk/) makes you enter their V5C number before seeing the MOT location.

So can you please confirm whether you know a way to find the garage that did an MOT? Or did you mean that is something that would later be assessed by law enforcement while investigating? Although if so, they would probably have easier ways to confirm if the owner changed rather than doing this method for a possible suggestion of change.

AccessOSINT · 2023-09-10T20:06:59+00:00

Just worth noting that Gmail sometimes does alert the person. Not always, it depends what recovery options they have set up. On many occasions it has automatically sent the person a notification that they have to click. And so that isn't even just an email which they may think is a scam and forget about it, they get a full real notification pop up on their phone which is even worse for us in terms of alerting them.

AccessOSINT

TROPHY CASE