Online identity

[Joe88]

http://bronies.cz/Uzivatel-osm70
http://talkhaus.raocow.com/search.php?author_id=1156&sr=posts
https://www.quizup.com/en/topics/my-little-pony?scope=country&country=CZ&time=all-time (3rd place)

 

[osm70]

http://bronies.cz/Uzivatel-osm70
http://talkhaus.raocow.com/search.php?author_id=1156&sr=posts
https://www.quizup.com/en/topics/my-little-pony?scope=country&country=CZ&time=all-time (3rd place)

Yes my accounts

 

[Catastrophic]

http://bronies.cz/Uzivatel-osm70
http://talkhaus.raocow.com/search.php?author_id=1156&sr=posts
https://www.quizup.com/en/topics/my-little-pony?scope=country&country=CZ&time=all-time (3rd place)

That bronies.cz site looks like fucking cancer.

 

[osm70]

That bronies.cz site looks like fucking cancer.

You mean the logo? That is randomly picked every month.
If you mean something else, OK your opinion.

 

[Digital.One.Entity]

Hehehe Ja-Brony..........

 

[osm70]

Hehehe Ja-Brony..........

?

 

[FAST6191]

Yes I am a Brony

In and of itself that means nothing (it is not like it is an embarrassing part of you). However if I have to try to tie accounts together that are not clearly linked then common interests between them, best if is a somewhat unique combination of them, then it becomes far more useful.

Also I found you linked to http://www.mediafire.com/download/n1go1efzp36qw77/MOV0004A.avi and claimed you encoded it yourself. I would then run it through something like http://www.headbands.com/gspot/ to see what it tells me.
Now video like this is not so useful as images and playing with http://regex.info/exif.cgi (phones like to do things like encode dates, times, GPS locations and more into them, all of which can be read by such things). Sadly facebook and a lot of image boards/hosters sanitise exif data for this reason but again it just takes one slip and you to host it on a normal site. I did scan one of the PNGs from your slideshow but it did not have much of anything in it (though at best I would have found what you saved/captures the image in).


Anyway for those playing along at home
First determine if you are facing someone that wants to hide and is actively doing so (possibly including false info), is cautious but not overly concerned or is clueless/unconcerned. Regardless of your target's position the key is more loose groupings and lots of them rather than trying for absolutes in the initial sweep. Countries, languages and more can inform how you read into things (grammar errors, regional word choices, slang choices and more all help).
Use what you have in front of you (name, location, age, signature, website links)
Use what the site you have info on gives you for more background. All the fancy tools I have covered or are about to cover are invaluable, however some good old likes and interests information is good to have. Moreover it can be the source of the one or two little things that broad automated searches (as I imagine at this point we do not have access to police or even signals intelligence type databases).
If you have something you can narrow down the person with (embed a link to a single pixel image in your post and if the target goes on it with a couple of dozen other people (or you have a time window) then you have quite a bit -- I am sure you all recall those forum signatures that say "you are on IP blah, using [webbrowser] with this operating system...." this is all transmitted to web servers you visit.
https://pipl.com/ is a wonderful site. "Is this username taken" type sites are also useful at times.
http://regex.info/exif.cgi is great for photos (phones do GPS tags and the like).
http://www.headbands.com/gspot/ is a start for video though it will likely have nothing of great interest here.
Good old fashioned search engines with the username and info you might be able to connect to them also works. Do remember you can use a minus sign in a search engine, and things like site: to restrict or remove certain sites from the search.
If you are in America you also have things like http://www.integrascan.com/ to play with. Be careful with services like this though.
In the UK the electoral roll is posted in a kind of sanitised version online (do a vanity search for yourself).
Do they have a domain? Do a Whois on it, if they have domain privacy find one of those server/IP reports. A lot of people will buy in a multihost package and share it with friends, family and local businesses that just need a site. They often not to use domain privacy and will get you near the same town as them (if the sites themselves do not give contact info).
CVs/resumes, even the sanitised ones, are great.
Do they have a picture of them with their car/motorbike? Most places I go will give me an insurance history or allow me to "text this reg number" and get something similar. Equally quite a few car/bike garages will have a proper hookup into the DVLA (UK) or DOT (US). If they do MOTs then even better and car resale is not much further behind.

From here we take more active steps, however these I have no great desire to cover right now.

P.S. if someone has that youtube series where the guy was guessing people's names/info about them and pretending like they knew them then please share. I appear to have to forgotten to bookmark it.

If you want a nice youtube video though the following is good

 

[RevPokemon]

Why? Do you want to watch some with him or something? LOL

No because I know you do it with him

 

[osm70]

In and of itself that means nothing (it is not like it is an embarrassing part of you). However if I have to try to tie accounts together that are not clearly linked then common interests between them, best if is a somewhat unique combination of them, then it becomes far more useful.

Also I found you linked to http://www.mediafire.com/download/n1go1efzp36qw77/MOV0004A.avi and claimed you encoded it yourself. I would then run it through something like http://www.headbands.com/gspot/ to see what it tells me.
Now video like this is not so useful as images and playing with http://regex.info/exif.cgi (phones like to do things like encode dates, times, GPS locations and more into them, all of which can be read by such things). Sadly facebook and a lot of image boards/hosters sanitise exif data for this reason but again it just takes one slip and you to host it on a normal site. I did scan one of the PNGs from your slideshow but it did not have much of anything in it (though at best I would have found what you saved/captures the image in).


Anyway for those playing along at home
First determine if you are facing someone that wants to hide and is actively doing so (possibly including false info), is cautious but not overly concerned or is clueless/unconcerned. Regardless of your target's position the key is more loose groupings and lots of them rather than trying for absolutes in the initial sweep. Countries, languages and more can inform how you read into things (grammar errors, regional word choices, slang choices and more all help).
Use what you have in front of you (name, location, age, signature, website links)
Use what the site you have info on gives you for more background. All the fancy tools I have covered or are about to cover are invaluable, however some good old likes and interests information is good to have. Moreover it can be the source of the one or two little things that broad automated searches (as I imagine at this point we do not have access to police or even signals intelligence type databases).
If you have something you can narrow down the person with (embed a link to a single pixel image in your post and if the target goes on it with a couple of dozen other people (or you have a time window) then you have quite a bit -- I am sure you all recall those forum signatures that say "you are on IP blah, using [webbrowser] with this operating system...." this is all transmitted to web servers you visit.
https://pipl.com/ is a wonderful site. "Is this username taken" type sites are also useful at times.
http://regex.info/exif.cgi is great for photos (phones do GPS tags and the like).
http://www.headbands.com/gspot/ is a start for video though it will likely have nothing of great interest here.
Good old fashioned search engines with the username and info you might be able to connect to them also works. Do remember you can use a minus sign in a search engine, and things like site: to restrict or remove certain sites from the search.
If you are in America you also have things like http://www.integrascan.com/ to play with. Be careful with services like this though.
In the UK the electoral roll is posted in a kind of sanitised version online (do a vanity search for yourself).
Do they have a domain? Do a Whois on it, if they have domain privacy find one of those server/IP reports. A lot of people will buy in a multihost package and share it with friends, family and local businesses that just need a site. They often not to use domain privacy and will get you near the same town as them (if the sites themselves do not give contact info).
CVs/resumes, even the sanitised ones, are great.
Do they have a picture of them with their car/motorbike? Most places I go will give me an insurance history or allow me to "text this reg number" and get something similar. Equally quite a few car/bike garages will have a proper hookup into the DVLA (UK) or DOT (US). If they do MOTs then even better and car resale is not much further behind.

From here we take more active steps, however these I have no great desire to cover right now.

P.S. if someone has that youtube series where the guy was guessing people's names/info about them and pretending like they knew them then please share. I appear to have to forgotten to bookmark it.

If you want a nice youtube video though the following is good

Yeah that is my video

 

[DinohScene]

Why should we care?

Also, shouldn't this be in EoF?

 

[FAST6191]

Why should we care?

Also, shouldn't this be in EoF?

It is a legit thread/request/exercise that most people are taking seriously. It is not that we care about the OP's details (or indeed the details of anybody), just that the OP put themselves up as a viable candidate for a public display/discussion of the relevant techniques.

 

[ComeTurismO]

googled your signature and got some my little pony shit --> shows you love my little pony --> you'll be good friends with bradzx

 

[master801]

Your birthday?

19 / 09-06-95

 

[osm70]

googled your signature and got some my little pony shit --> shows you love my little pony --> you'll be good friends with bradzx

Who is that?

Your birthday?

19 / 09-06-95

Correct

 

[Satangel]

Nice idea, I bet if people did this with me they would come up with way too many stuff. Downside of using the same nickname on just about anything :/

 

[Duo8]

Someone try me.

 

[FAST6191]

Someone try me.

Going straight to pipl.com did not do much for me here so I had better refine it.

Duo8 and Vietnam on your country flag, I believe that flag to be accurate from past conversations. Male, 16 in your profile here (Sep 30, 1998 being the birthday).

Nothing in your signature or profile to indicate a website.

Again I am going passive rather than trying to guess passwords or find your IP somehow.

I started to go through your post history but that was taking ages.

Doing a search with the term "duo8 gbatemp -site:gbatemp.net" though without the quotes.

http://www.reddit.com/user/duo8

http://www.reddit.com/r/Club_Ninten...ub_nintendo_is_blocking_non_us_ips_to/cobvrrb would appear to indicate a non US location, though times on your posts would probably do much the same.

From the same search https://www.tinhte.vn/threads/cap-nhat-tinh-trang-hack-3ds.1370029/ (I hope I have not linked a ROM site) and would appear to help confirm the Vietnam thing at some level.

Also from the same search https://twitter.com/smealum/status/556596883527696385 leads me to https://twitter.com/Hyper_follower

Carrying on with that search
http://tinhte.meo4.info/threads/cap-nhat-tinh-trang-hack-3ds.1370029/ though the site layout looks identical so I would probably just do some site investigation (hosted IPs, whois and whatever else) to make sure I am not analysing a spam clone site, like what most of the rest of the results of said search were.

I probably should refine that search a bit more as I am getting things like Duo 8 Gb as false positives.

Anyway I have a twitter account to look at now. That says Hanoi.

The twitter page says you have followed https://www.youtube.com/user/Shokio (a rather low subscriber channel) so I would probably look for anything similar in the comments there. Apparently I have to sign in to see more and I can not be bothered to borrow someone's account to do that. For the youtube comments I would probably have to see if you linked any of their videos on twitter, GBAtemp or reddit and then go accordingly.

reddit, twitter and gbatemp would all indicate you are reasonably versed in this computer lark.
From what I have seen you do not use any of your own domains/hosting.

For giggles I tried the previous search on yahoo and it got back
http://nintendoeverything.com/disable-3ds-region-lock-with-new-workaround/

You are mentioned in http://www.scribd.com/doc/227145544/Remote-StreetPass-Relay-MAC-s as well, however scribd and my browser do not get along it would seem. It looks more like a simple mac address for the streetpass faking anyway rather than something interesting. For some things I might have been able to figure out the brand of the router and use it to guide an attack out the router.

https://gbatemp.net/threads/need-a-good-root-explorer-app.352752/#post-4737934 would appear to indicate some phone specs, though not the model. I would try for a model but being as close as you are to China it is likely some generic thing.

 

[Duo8]

Hmm... I'll try to review this

Going straight to pipl.com did not do much for me here so I had better refine it.

Duo8 and Vietnam on your country flag, I believe that flag to be accurate from past conversations. Male, 16 in your profile here (Sep 30, 1998 being the birthday).

Nothing in your signature or profile to indicate a website.


Again I am going passive rather than trying to guess passwords or find your IP somehow.

I started to go through your post history but that was taking ages.

Doing a search with the term "duo8 gbatemp -site:gbatemp.net" though without the quotes.

http://www.reddit.com/user/duo8

http://www.reddit.com/r/Club_Ninten...ub_nintendo_is_blocking_non_us_ips_to/cobvrrb would appear to indicate a non US location, though times on your posts would probably do much the same.
All true so far

From the same search https://www.tinhte.vn/threads/cap-nhat-tinh-trang-hack-3ds.1370029/ (I hope I have not linked a ROM site) and would appear to help confirm the Vietnam thing at some level.
Lots of pirated content there actually, but mostly in the mobile forums.

Also from the same search https://twitter.com/smealum/status/556596883527696385 leads me to https://twitter.com/Hyper_follower
Reminds me that I haven't updated it yet.

Carrying on with that search
http://tinhte.meo4.info/threads/cap-nhat-tinh-trang-hack-3ds.1370029/ though the site layout looks identical so I would probably just do some site investigation (hosted IPs, whois and whatever else) to make sure I am not analysing a spam clone site, like what most of the rest of the results of said search were.
Seems like a version of the above site.

I probably should refine that search a bit more as I am getting things like Duo 8 Gb as false positives.
lol

Anyway I have a twitter account to look at now. That says Hanoi.

The twitter page says you have followed https://www.youtube.com/user/Shokio (a rather low subscriber channel) so I would probably look for anything similar in the comments there. Apparently I have to sign in to see more and I can not be bothered to borrow someone's account to do that. For the youtube comments I would probably have to see if you linked any of their videos on twitter, GBAtemp or reddit and then go accordingly.

reddit, twitter and gbatemp would all indicate you are reasonably versed in this computer lark.
From what I have seen you do not use any of your own domains/hosting.

For giggles I tried the previous search on yahoo and it got back
http://nintendoeverything.com/disable-3ds-region-lock-with-new-workaround/

You are mentioned in http://www.scribd.com/doc/227145544/Remote-StreetPass-Relay-MAC-s as well, however scribd and my browser do not get along it would seem. It looks more like a simple mac address for the streetpass faking anyway rather than something interesting. For some things I might have been able to figure out the brand of the router and use it to guide an attack out the router.
That's Tane's MAC cycle spreadsheet. Surprised you didn't see it here first.
That router has the rom-0 access exploit but I replaced it.

https://gbatemp.net/threads/need-a-good-root-explorer-app.352752/#post-4737934 would appear to indicate some phone specs, though not the model. I would try for a model but being as close as you are to China it is likely some generic thing.
Not a "generic" one, and I believe I've posted it here several times. Changed to another now (I told you about it actually).

Oh good. No personal information.

 

[RCJayce]

Hmm this looks very interesting so here we go.

RCJayce and LeoFravega are my Online ID'S

Let's see what you can find

 

[FAST6191]

Start with what you have in front of you

Buenos Aires, Argentina. No signature, no birthday, no website in the profile.

RCJayce on pipl got nothing, LeoFravega got far more (at time of writing this line I have no idea how easy it would have been to find that).
https://pipl.com/search/?q=LeoFravega&l=&sloc=&in=6

Several hits in Argentina, however I have no idea how common a name that is.
http://www.studentsoftheworld.info/penpals/stats.php3?Pays=ARG says 71 for Leo, http://surnames.behindthename.com/top/lists/ar/2006 does not list the latter and http://forebears.io/surnames/fravega says it is not that common either.

https://www.facebook.com/leo.fravega references an Argentine football club ( http://www.cariverplate.com.ar/ ) so better than nothing for location. For some reason it links to https://www.facebook.com/fravegaonline which is the facebook part of some vendor of electronics (though when I searched fravega that was what came up).

http://www.taringa.net/LeoFravega/informacion also appears as part of pipl. Never heard of the site but it appears to be one of those home grown social media things.
Most interesting part of that
Nombre Leonardo
Fecha de nacimiento 11 de Julio de 1990
Old account from http://www.taringa.net/ADMLedah/seguidores no idea what ADM stands for but if I had to guess it would be a game clan (various other game posts on other social media sites seem to have lots of games where clans can be a useful thing).

https://plus.google.com/photos/1161...5890540460882832674&oid=116125588842577804367
Might be you in there somewhere, was taken a while back as well and the taker was using a Samsung Galaxy Ace GT-S5830L (love exif data), sadly no GPS.

Twitter
https://twitter.com/LeoFravega
Has a profile photo https://pbs.twimg.com/profile_images/537958888780206080/xTEiZRhe.jpeg
Tagline would appear to reference kingdom hearts. You have mentioned kingdom hearts in posts but that is not a strong link at all. An old tagline might have been "Ninguno de nosotros puede prometer ser perfecto, lo unico que podemos hacer es la promesa de amarnos con todo. Porque amar es la mejor cosa que hacemos."

If I was better at matching people to pictures I would try, I am truly awful at it though and I am not sure the missing part of eyebrow (usually a piercing but who knows) is going to help here.


Going down through twitter you link to the instagram of calatayudevelyn ( http://instagram.com/p/yBfc8OuhIy/ possibly being another picture). Though pipl also mentions you being mentioned in https://twitter.com/Evelyncalatayud/status/563577796631756800 so now we have something of a connection and something else to look through if I was properly going for it.

Anyway pipl.com is fun but it might be slightly too easy. Starting with GBAtemp, I have not gone through every post in depth (rather just the summaries that the find all content gives)
Your intro post
http://gbatemp.net/threads/hello.370385/
Leo from Argentina.

You link a video in a post ( http://gbatemp.net/posts/5106801/ )
https://onedrive.live.com/?cid=533e...001&ithint=video,mp4&authkey=!AH_9CqQ1D-oWTjA

Clicking on the folder properties tells me Leonardo Fravega last edited it back in September. That would be a start I guess, whether I would have gone to Leo straight away is a question for the ages (if I was good I would have but this is not quite my everyday gig).

Your profile says you work in IT and I have no reason to disbelieve that having now gone through your posts.

Back to pipl then with Leonardo Fravega (I will leave Argentina off for the time being)

https://pipl.com/search/?q=Leonardo+Fravega&l=&sloc=&in=6

Well that was easy. I have LeoFravega again and a location saying Gualeguaychú, Argentina. Looking on a map it is not all that far north of Buenos Aires, no idea what is more accurate of if this is just a "people know where Buenos Aires is and I can get there in a few minutes so I will say I am from there" type scenario.

Facebook account https://www.facebook.com/leonardo.fravega
However it does say about Christian events (assuming my basically nonexistent Spanish holds) and one of your posts says about atheism so who knows.

This pipl search is not so good
http://badoo.com/01097989313/ appears but is a 37 year old person. Given the apparently uncommon surname I have to wonder if I have not found your uncle or something, or perhaps not as Comodoro Rivadavia is a bit of a stamp from Buenos Aires.

I now have some google accounts to look through, three different ones
The one I found earlier leads me to a youtube channel
https://www.youtube.com/channel/UChQE8hpr5Ncfvft-2kBRN_Q has mainly games and pop music as subscriptions and likes.


https://plus.google.com/116371219896907375342/about
https://plus.google.com/117337566938209087514/about is possible and says Gualeguaychu but also says barman as a job.

I do not immediately recognise any names of friends from earlier findings but they do go down on the notepad in case I am doing more.

https://www.linkedin.com/pub/leo-fravega/2b/a73/562 also comes up, it might be for that facebook account from before that linked to fravega the company as this one also links to it.

Back to google
http://www.myrepospace.com/profile/Leofravega

Hits for
ps3hax.net
spiffy360.com
mpgh.net (multiplayer game hacking)
http://forum.xda-developers.com/member.php?u=4671583
http://video.twicsy.com/i/tLeLh
http://six.tweettunnel.com/reverse2.php?textfield=LeoFravega
http://www.grupoandroid.com/topic/47060-resuelto-bateria-no-carga-al-100/#ipboard_body
http://www.darkreloaded.com/user/294375-leofravega/

I found a comment by one leofravega on a Spanish torrent site (Ismael 2013, a user by that name liked it back in mid December)