Tools to Look Beyond the Mask

A working tour of open-source intelligence (OSINT) tools shows how little information a recruiter actually needs to build a full picture of a candidate: a Twitter handle, an email address, or a username is often enough to surface phone numbers, home addresses, relatives, past employers, and every other social account a person has ever used.

Several tools are demonstrated live, with real searches, including:

• A tool that takes a Twitter handle and returns linked accounts, hashtags, mentioned users, frequently used words, and other profiles connected to that identity.
• An email-based lookup that surfaces external accounts tied to that address, from coding sites to forums to investigation platforms, each with a direct link to the profile.
• People-search sites that take a name and return phone numbers, past addresses, email addresses, household size, and years at a residence, with an accuracy rate high enough to be genuinely useful despite some outdated fields.
• A contact-finder built for high-volume searching across millions of records, with a Chrome extension that works on LinkedIn, GitHub, Stack Overflow, and Meetup, and that supports reverse phone lookups, address searches, and bulk list enrichment.
• A family-tree style search that maps out relatives, associates, and historical addresses and phone numbers from a single starting point.
• Username-checking tools that test whether the same handle is registered across dozens of platforms at once, useful for tracking someone across sites when only a screen name is known.
• An image-forensics approach for spotting fake profile photos, checking where else a picture appears online and whether it's tied to more than one identity.

Throughout, the guidance is practical rather than theoretical: separate or combine last names depending on the tool, treat any single match as a lead to confirm rather than a confirmed fact, and expect accuracy in the range of seventy to ninety-five percent depending on the tool and data type. Addresses turn out to be one of the most useful pieces of information to collect early, since several tools use them to cross-reference and confirm identity later in a search.

The overall approach is about layering free and low-cost sources rather than relying on any single database, using each new piece of information, an email, a number, a username, to unlock the next one.