Profiling People

Give me one email address and I can usually reconstruct a decent slice of someone's online life inside an hour. The reason is that people reuse handles. The gamer tag from 2011 is the GitHub username in 2024 is the Reddit account where they complained about their employer's VPN last month. Humans are consistent, and consistency is a footprint.

On an engagement you rarely start from nothing. You start from a corporate email format, first.last@company.com, harvested from a data breach or the company's own site. From there you fan out.

Pivot on the username

The fastest first move is checking which platforms a handle exists on. Sherlock is the tool people reach for, and it is fast enough to be a reflex.

$sherlock jsmith

Sherlock reports false positives on sites that return 200 for any username, so treat every hit as a lead to verify by hand, not a fact. Open the profile. Confirm it's the same person by matching a photo, a bio, a location, or a writing style. One confirmed cross-platform account often leaks a real name, a city, or a second email.

Turn names into email addresses

When you have a real name and a domain but no address, guess the format and verify. Companies use a handful of patterns: first.last, flast, firstl, first. theHarvester and hunter-style logic will surface the format if even one address is already public.

Once you know the format is flast@company.com, you can generate the full employee list from any roster of names you scraped off LinkedIn. That list is the raw material for a phishing campaign or a password-spray target set.

Check breach exposure the honest way

Have I Been Pwned tells you which breaches an address appeared in, for free, without handing you plaintext passwords. Use its API rather than the paid "lookup" sites that are half scam.

$curl -s -H "hibp-api-key: $HIBP_KEY" "https://haveibeenpwned.com/api/v3/breachedaccount/target@company.com"

A hit tells you the account was exposed and where. That matters for two reasons. It signals the person reuses services carelessly, and the named breach tells you roughly how old any leaked credential would be. Old credentials still work more often than they should.

Read the social footprint for a pretext

The goal of people-profiling is rarely the person for their own sake. It's the pretext: the believable story you'll use to get a click or a callback. LinkedIn tells you who reports to whom, so you know whose name a fake email should spoof. A tweet about a conference tells you where they are this week. A GitHub commit history tells you what stack they touch, which makes a fake "your build is failing" email land.