Using OSINT To Unmask A Paedophile Online

Firstly I’m not going to identify this person on here, either by their real name or even their assumed name but the full details have been passed to the Police and a number of Journalists. So for the benefit of this article, I will refer to Person A when meaning their true identity and Person B when meaning their assumed identity.

?

On Tuesday night I got a Linkedin request from Person B, a True Crime Writer, who is on here under an assumed name, who is actually a convicted Paedophile & Fraudster and quite frankly not a nice person at all.

?

But how do I know this?

?

Well a little while ago I had reason to research them after hearing of concerns about their behaviour when they were approaching a number of vulnerable victims of crime. So without access to police databases or court records, which in the UK are fairly restricted, I had to use Open Source Intelligence techniques to legally access publicly available content to confirm their identity.

?

The reported behaviour had been similar to that which Person A had previously been reported for. So researching Person A online, searching their name as a “phrase” on a search engine, I was able to locate a number of news articles which confirmed that they had previous convictions in the UK for paedophile related offences, as well as fraud related offences.

?

Remember when reading online news articles about an individual being convicted at court, as well as reporting on the offence which someone has been prosecuted and convicted for, at sentencing an individual’s previous convictions are usually read out in court and may well be reported on in some articles.

?

So then I researched Person B, who had the normal online social media accounts and a website.

?

An obvious red flag was that there were no photographs of Person B on any of their online accounts, just a logo. Had there been a photograph of a person then I could have done a Reverse Image Search, to see where else that image had been used, or even to identify if it was an image created by AI and not that of a genuine person.

?

The next red flag was that all of the online accounts had been created recently, all around the same date. On my website at https://www.uk-osint.net/ you can find details on how to locate when certain online sites were created.

?

Whilst it is easy to create any number of online accounts for a fake profile, what people can’t so easily create is a history for that fake profile. So online a person may look genuine, however they have only looked genuine for maybe a few months, whereas with genuine identities you are often able to locate information online going back a number of years. Just think about how old your real personal Linkedin or Facebook accounts are.

?

Using online genealogy sites, such as FindMyPast & Ancestry I was able to confirm that the name used by Person B did not show any linked Birth Death & Marriage data. I know sites like FindMyPast only have records going up to 2007 and not everyone is shown on them but they are a good start.

?

When I first started doing online research into Fraud cases in the late 1990’s, years before I had even heard of the term OSINT, it was very easy and free to do a WhoIs search on any Domain Name, to see who the Registered Owner of a Domain Name was. Now with the changes brought about a few years ago with GDPR it is far from easy, however Nominet, the UK Internet Registration Authority, will in certain circumstance still respond to lawful relevant request to identify the owner of a UK Domain Name.

?

So as this person was running a website with a .uk Domain Name and he fitted the criteria, Nominet were able to supply the details of the owner of the Domain Name along with their full contact details. There is a link for this on my website at https://www.uk-osint.net/domainsandips.html.

?

Whilst the name used was false the address and mobile number supplied were very useful, as I was able to research them on sites such like TraceIQ & GB Connexus / Investigate, which as well as having public Edited Electoral Roll data have lots of Consented Data, including email addresses and mobile phone numbers for people in the UK. So in this case we were able to link both the address and mobile number used by Person B to register their Domain Name as ones also linked to Person A.

?

So we were able to link Person A to Person B and show that this convicted Paedophile & Fraudster has a whole new identity online and is still a danger to vulnerable people. ?

?

So OSINT can be used to prove an identity is real, prove an identity is fake and also to prove links between identities.?