Have you ever considered how often your location might be disclosed to strangers? Many people, without considering operational security, share their whereabouts regularly, even with GPS tracking disabled on their devices. A backyard photo, a Google review, or a school jacket sleeve visible in a closet—all these can be pieced together by a savvy investigator or someone with ill intentions to pinpoint a target. These unintentional clues create a trail that can be followed like a treasure map.
This blog post aims to teach other investigators how to locate a target using OSINT techniques, while also offering tips on safeguarding their own location information from being unintentionally exposed.
If you know the target's name and they are likely in the United States, public data aggregators like Intelius and Spokeo can potentially provide addresses linked to that individual. However, these tools often yield false positives, so it's important to verify the information through official sources like county assessor websites, or unofficial ones, such as images or other details shared by the targets or their families.
When investigating an address in the United States, information about the property owner can be accessed through the county assessor's property record lookup. First, determine in which county the property is situated and then locate the corresponding county assessor's website. These websites often have an outdated design; if the search feature is not easily visible, try entering “[name] county property records” into a search engine like Google.
Property record searches are frequently conducted using a tool that is separate from the assessor's website. The search function generally requires just the street name for accurate results — for instance, if the address is 123 Main St., you should only enter “Main” in the “Street” field. A “Suffix” field is sometimes available for additional detail. However, this is not always the case, as some assessor websites, particularly in major cities, have more modern and comprehensive search capabilities, though this is uncommon.
Certain property record searches allow for searching by name, which can significantly simplify the process if the investigator knows the target’s name. It is important to confirm the information with other sources to avoid false positives, especially when multiple individuals share the same name.
Example of a Property Address search on a county assessor website.
Seemingly trivial information can reveal a lot. Many people enjoy leaving reviews to support local businesses, and a collection of reviews in a particular area can provide insights into a person’s routines and whereabouts. A series of reviews from a specific town or city over a prolonged period suggests the individual may reside there.
A useful tool for analyzing Google accounts is GHunt. By entering a Google email address, the tool retrieves accessible data for easy examination, including links to the person's Google Reviews and a potential location.
Investigators should personally examine the reviews, as the tool can only estimate the likelihood of a location, while the reviews might offer additional details. For instance, if there are only a few reviews over an extended period, it’s more probable that the person lives there, unlike numerous reviews in a short span, which might indicate a vacation. Reviews can also reveal more about the individual’s life, such as a review of a mechanic specializing in a rare type of car or a positive review of a pool installation company.
Frequently, individuals will include their location on social media. On X, this detail is displayed just below the bio on a person's profile. On Facebook, you can find this information in the "Intro" section of the main profile or deeper within the "About" tab.
Bill Gates’ X profile, showing his location in Seattle, Washington.
Facebook also allows users to search by location. By entering a name in the search field and selecting "People" under the Filters, you can access various options like City, Education, and Work. These filters can be useful for narrowing down a target's location if you have some general information.
It's important to remember that these geotags are self-reported and can sometimes be inaccurate or intended as jokes.
Skype remains a surprisingly effective tool, as many users have their locations publicly visible. While a Skype location might be outdated, it can still help confirm existing information.
An example of a geolocation on Skype.
If a location isn't immediately obvious, the next step is to use the saying "a picture is worth a thousand words." People often share their lives on social media, unintentionally revealing stories. X conveniently gathers all images shared by an individual in the "Media" tab. On Discord, you can search within servers using “from:username has:image” to find images from a specific member. Examine any photos a person has shared, as they can unveil a wealth of information.
An example of Discord member image search.
Many websites and applications currently remove metadata from uploaded images, yet some, like Flickr, do not. It's advisable to run images through a metadata/EXIF data viewer to check for any remaining information. Although this method is not frequently successful, it can be a significant time-saver when it is.
A careless individual may accidentally upload a photo taken in their yard that distinctly reveals the street name and house number. Such breaches in operational security occur surprisingly often. When examining images, focus on prominent features like buildings, schools, mountains, or oceans, and think about what the person might be revealing with them. Is there a car in the image? Look for reflections, as house numbers could be visible in car windows. You can match geographical features in the images with those found on Google Maps.
If a landmark is unfamiliar, consider using a reverse image search. Many people have taken and uploaded pictures of landmarks, which can often provide helpful information.
An example of a landmark reverse image search, showing the correct locational results.
There are very powerful tools capable of running searches on landmarks. One such tool is Bellingcat’s OpenStreetMap search tool. It uses data from OpenStreetMap, a detailed crowdsourced world map. With OSM-search, users can input multiple landmarks (e.g., a gas station near a grocery store with a telephone pole in front), and it will return results where those landmarks intersect if mapped on OpenStreetMap.
People often express themselves through their clothing choices. School spirit items can indicate where someone resides. These indicators don't need to be worn; they could be a shirt visible in a closet or a diploma displayed on a wall. In photos taken inside a vehicle, check for a GPS display or any visible landmarks or street signs outside the window.
A Sun Angle calculator can be used to determine a location. When an image or video includes a time and date stamp, and the location is uncertain, this tool can help narrow down the possibilities. Although not commonly used, it’s a valuable resource to have. Youri van der Weide from Bellingcat provides an excellent guide on the methodology in this blog: .
Everything mentioned above also applies to videos, but videos have the added benefit of sound. Accents, for instance, can provide clues about a person's location. It's beneficial to have a native speaker of that accent listen, as they can offer more detailed insights and notice subtleties that others might overlook. For example, a southern accent might seem generic to someone unfamiliar with the region, but a southerner could likely distinguish whether it's from Texas or Alabama.
Environmental sounds, such as traffic, ocean waves, or radio stations, can also be useful in identifying a location. Radio stations, in particular, can be quite revealing if they mention their name, as most are limited to specific regions. This website serves as an excellent resource for locating radio stations.
IP addresses can indicate a broad geographical region but lack precision beyond that. To determine this, first verify that the IP is not associated with a VPN or a Tor exit node. If it isn't, the IP will provide a very general location. These results are typically imprecise and should only be used to ascertain if a target falls within a large geographical area.
In an earlier Unit 221B blog post, we discussed how usernames can provide valuable insights. A username in a foreign language might suggest the person resides in a country where that language is spoken. Similarly, if a username contains a local reference, it's probable that the person lives in the area relevant to that reference. For instance, someone with the username “YinzerPride” is likely from Pittsburgh, Pennsylvania, as "Yinzer" is a term unique to that region.
When an investigator examines a person's text, whether on social media or in Discord servers, identifying specific phrases can be advantageous. Look for keywords related to the individual, such as "school," "work," "state," or "live." Consider how someone might describe themselves with statements like "I work at Walmart" or "I live in Wisconsin." Think of other words or expressions the target might use in everyday conversation and check if they've unintentionally revealed information. This is particularly beneficial when these texts include a photo, such as "Took this at my school's pep rally tonight." Such instances are truly valuable.
Improving geolocation skills requires practice, and several free resources are available for those interested.
One option is the geolocation challenges on X (formerly Twitter), organized by Quiztime. These challenges consist of Quiztime members posting an image and asking participants to identify the location or uncover other details about the image. Beware of potential spoilers in the comments!
Geolocation quiz on Quiztime, by Julia Bayer. https://twitter.com/bayer_julia/status/1782515353433567292
Another enjoyable method to practice is by using MapCrunch, which randomly places the user in a Google Maps Streetview location. A popular challenge on MapCrunch is the Airport Game, where players must navigate from their starting point to the nearest airport to "escape the country."
Geoguessr, a long-standing geolocation practice game, now requires a subscription. It is more interactive than the self-guided MapCrunch, challenging players to identify random Streetview locations with various constraints, such as limited guesses or time.
A useful site for study is Geohints. It provides region-specific information about various identifiers like gas stations, architecture, and license plate styles.
Additionally, observing professional Geoguessr players share their strategies can be very beneficial. These players have developed many techniques for rapid location identification. One well-known player, Trevor Rainbolt, shared some of his insights in an informative Wired interview.
Given the significant role geolocation plays in investigations, it's unsurprising that malicious individuals exploit it for their own ends. Stalkers, thieves, and other harmful actors utilize online information to inflict harm, even from a distance. The act of doxxing, which involves maliciously publishing someone's private information online, is a well-known threat among internet users. A notable instance is the 2016 robbery of Kim Kardashian, where criminals used her social media to track her location and steal over $10 million worth of jewelry.
To protect your location information when sharing online, consider the following measures:
As people frequently share a substantial amount of information about their location, either intentionally or accidentally, it's essential for investigators to leverage this data effectively. Developing the ability to distinguish between useful and irrelevant information is a skill that requires practice. Successfully identifying a target's location is vital for a fruitful investigation, as it significantly aids law enforcement in focusing their efforts. Furthermore, possessing this knowledge helps ensure the investigator's own safety during online activities.
Additionally, corroboration is paramount. Investigators must consistently keep this principle in mind. Mistakenly accepting false positives can have serious consequences for innocent individuals—never assume that something stated by a single source is undeniably true. Therefore, investigators should always verify information from multiple sources to ensure accuracy and protect those who might be wrongly implicated.