Auditing Your Personal Footprint

Learning Objectives

• After this, students can build a list of their own identifiers (names, usernames, emails, phone numbers, photos) to audit.
• After this, students can run a structured, step-by-step OSINT audit on themselves using the techniques from the intro lesson.
• After this, students can record findings in a tracking sheet without creating a new privacy risk.
• After this, students can rank findings by risk and decide what to fix first.

Why Audit Yourself First

Everything in the intro lesson works in both directions. The same searches a pentester runs against a company, or an attacker runs against a target, can be run against you. The difference is that when you run them on yourself, you get to fix what you find before someone else uses it.

A self-audit matters for three reasons:

1. You can’t fix what you don’t know about. Most people have no idea that a people-search site lists their current address, their relatives, and their phone number, or that an old forum account from high school still shows their full name next to their username.
2. The mosaic effect applies to you. A gym check-in, a dog’s name, a photo of your street, and your graduation year are harmless alone. Together they can give someone your routine, your home, and the answers to your security questions.
3. You are part of your organization’s attack surface. Attackers often reach a company through its people. Your personal footprint (your role, your email format, your interests) is what makes a spear-phishing email convincing.

Think of the audit as a pentest where you are both the client and the target. You have full authorization, and the goal is a list of findings with fixes.

Before You Start

Set some ground rules

• Audit only yourself (or someone who has explicitly asked you to help them). This is the class rule from Legal & Ethical Boundaries.
• Timebox it. A first pass takes 45–90 minutes. You can go deeper later.
• Protect the audit itself. Your findings sheet is a ready-made dossier on you. Store it in an encrypted location (a password manager’s secure notes, an encrypted drive), not a shared folder.

Search like an outsider

Search engines and social platforms personalize results and show more to people who are logged in or connected to you. To see what a stranger sees:
- Use a private/incognito browser window and stay logged out.
- Try more than one search engine (Google, Bing, DuckDuckGo). They index different things.
- Use “view as public” features where platforms offer them (for example, LinkedIn’s public profile view).

Build your identifier list

Before searching, write down every identifier that could lead back to you. This becomes your search list.

Identifier type	Examples to include
Names	Legal name, nicknames, previous/maiden names, common misspellings
Usernames	Current handles, old gamer tags, handles from old forums or school accounts
Email addresses	Current, old, school, work, “throwaway” addresses you actually used
Phone numbers	Current and previous numbers
Addresses	Current and previous home addresses, hometown
Affiliations	School, employer, clubs, teams, volunteer organizations
Images	Profile pictures you use (or used) across accounts

The Audit Checklist

Work through these steps in order. Each step builds on what the previous one finds, which is the same pivoting process from the OSINT Cycle.

Step 1: Search engines

• Search your name in quotes, alone and with context:
• "First Last"
• "First Last" "City"
• "First Last" "School Name"
• "First Last" "Employer"
• Try name variations and nicknames.
• Use site: to check specific platforms: "First Last" site:linkedin.com, site:reddit.com "yourusername".
• Check the Images tab for your name.
• Go past the first page. Old and forgotten content usually lives on pages 2–5.

Google’s Results about you tool can also scan Search for results that show your phone number, home address, or email address (and, since February 2026, government ID numbers). Using it is covered in 9.2-reducing-personal-exposure.md.

Step 2: Usernames

• Search each username in quotes on multiple search engines.
• Run your usernames through a username enumeration tool such as WhatsMyName or Sherlock (introduced in the intro lesson). They check whether an account with that name exists on hundreds of sites.
• For each hit, confirm it’s actually yours. Other people may use the same handle.
• Note old accounts you forgot about. These are often the most revealing because you set them up before you thought about privacy.

Step 3: Email addresses

• Search each address in quotes. Emails sometimes show up in old forum posts, public documents, mailing list archives, or code commits.
• Check each address on Have I Been Pwned to see which known breaches include it. Sign up for its free notifications while you’re there.
• Check whether the email is tied to a public profile picture (for example, through Gravatar).
• Remember that a breach listing tells you which services you used, which is itself useful to an attacker.

Step 4: Phone numbers

• Search your number in several formats: "555-123-4567", "(555) 123-4567", "5551234567", "+1 555 123 4567".
• Check what messaging apps show to someone who has your number (profile photo, name, “about” text). Many apps let you limit this to contacts only.
• Be aware that crowdsourced caller-ID apps may attach your name to your number because it’s saved in other people’s contacts.

Step 5: Social media from the outside

For each account you found or already know about:
- View it logged out, or ask a friend who isn’t connected to you what they can see.
- Check your bio and links, profile and cover photos, friends/followers lists, tagged photos, check-ins, and old public posts.
- Look for posts other people made that tag or mention you.
- On LinkedIn, check your public profile view to see which sections are visible to search engines.

Step 6: Photos

• Reverse image search your profile pictures (Google Lens, Bing Visual Search, TinEye). This shows where else the same photo appears and links accounts you might have thought were separate.
• Look at the background of your public photos the way an investigator would: house numbers, street signs, license plates, school logos, badges, mail, screens, the view from your window.
• If you’ve posted original photo files on a personal website, blog, or forum, download one and check it with exiftool for GPS coordinates:
  

  exiftool -gps:all -DateTimeOriginal -Model photo.jpg
  

Step 7: Data brokers and people-search sites

• Search your name and state on the major people-search sites (for example, Whitepages, Spokeo, BeenVerified, Instant Checkmate, TruthFinder, Intelius, PeopleFinders, TruePeopleSearch, FastPeopleSearch).
• Note what each listing shows: current and past addresses, phone numbers, age, relatives, associates.
• Don’t pay for “full reports.” The free preview is usually enough to know you’re listed.
• Record the URL of each listing. You’ll need it for opt-outs (see 9.3-data-broker-opt-outs.md).

Step 8: Breaches and stealer logs

• Have I Been Pwned (Step 3) covers known breaches.
• Hudson Rock offers free lookups to check whether an email, username, or domain appears in infostealer logs (data stolen by malware from infected computers). A stealer-log hit is more urgent than a breach hit because it often includes saved passwords and session cookies from the infected device.
• If you get a hit: change the affected passwords, turn on MFA, sign out of all sessions, and scan or reinstall the infected device.

Step 9: Public records

• Check your county’s property records if you or your family own a home.
• Check your state’s court records portal and business entity search if relevant.
• You usually can’t remove public records, but you should know they exist because data brokers copy them.

Step 10: Old and forgotten accounts

• Search your email inboxes for phrases like “welcome to”, “verify your email”, and “confirm your account” to find services you signed up for years ago.
• Check your password manager and your browser’s saved passwords for a list of sites.
• For each forgotten account: decide whether to delete it, lock it down, or keep it (see 9.2-reducing-personal-exposure.md).

Step 11: What other people post about you

• School, team, and club websites (rosters, photos, news posts)
• Employer “meet the team” pages
• Family members’ public social media (tagged photos, “proud of my kid at [school]” posts)
• Local news, obituaries, and wedding announcements (these often list family relationships and maiden names)

Step 12: Pull it together and think like an attacker

Look at everything you found as a whole and ask:
- Could someone find my home address?
- Could someone figure out my daily routine or where I am right now?
- Could someone answer my security questions (mother’s maiden name, first pet, high school)?
- Could someone impersonate me convincingly (photo, name, writing style, friends list)?
- Could someone guess my email address or username pattern for other sites?
- Could someone use my job or school to build a believable phishing email?

Recording What You Find

Use a simple tracking sheet. Each row is one finding.

#	What was found	Where (URL)	Identifier	Who can see it	Risk	Action	Status
1	Current home address + relatives	people-search site listing	Name	Anyone	High	Opt out	Submitted
2	Old forum account with full name	forum profile	Username	Anyone	Medium	Delete account	To do
3	Email in 2 breaches	Have I Been Pwned	Email	Anyone who checks	Medium	Change passwords, enable MFA	Done
4	Running routes starting at home	fitness app	Name	Public	High	Hide map start/end	Done

Tips:
- Take a dated screenshot of each finding before you remove it, so you can confirm later that the removal worked.
- Record where you found it, not just what, so you can re-check.
- Keep the sheet encrypted and private.

Prioritizing by Risk

You will probably find more than you can fix in one sitting. Rank findings by how likely they are to be misused and how bad the result would be.

Risk	Examples	Why it matters	First action
High	Home address (especially with photos of the house); real-time location; government ID numbers; passwords in breaches or stealer logs; answers to security questions; children’s schools or routines	Enables physical harm, account takeover, or identity theft	Fix today: opt out, change passwords, lock down location sharing
Medium	Full date of birth; employer and role; reused usernames; list of relatives; regular routines (gym, commute)	Fuels phishing, pretexting, and pivoting to other accounts	Fix this week
Low	General interests; professional info you want public	Useful context for an attacker but low direct harm	Review and decide; may be fine to leave

Consider your personal threat model

Your priorities depend on who might actually target you:
- Everyone faces opportunistic scammers and phishing. Focus on breaches, passwords, and security questions.
- People in sensitive roles (IT admins, finance staff, executives, security staff, public-facing people) are more likely to be targeted specifically because of their job. Focus on what links your personal life to your work.
- People with a specific threat (a stalker, an abusive ex, online harassment) need to prioritize home address and real-time location above everything else, and should look into specialized resources such as state address confidentiality programs.

Re-check regularly

Your footprint changes. Re-run a lighter version of the audit:
- Every 6 months
- After life events: moving, a new job, a new school, a breach notification, or a viral post

Key Terms

• Digital footprint: all the information about you that exists online, whether you posted it or someone else did.
• Identifier: a piece of information that can be used to find or link records about a person (name, username, email, phone, photo).
• Mosaic effect: harmless individual facts combining into sensitive knowledge.
• People-search site: a consumer-facing data broker that sells or displays profiles of individuals.
• Infostealer / stealer log: malware that steals saved passwords, cookies, and other data from an infected device; the stolen bundle is called a stealer log.
• Threat model: an assessment of who might target you, what they want, and how they might get it.

Key Takeaways

• OSINT yourself before someone else does: same techniques, opposite goal.
• Start with an identifier list: names, usernames, emails, phones, addresses, photos.
• Search logged out, on multiple engines, and past page one.
• Check people-search sites, breaches, and stealer logs, not just social media.
• Record every finding with where you found it, and keep that sheet private.
• Fix high-risk items first: home address, real-time location, passwords, security question answers.
• Re-audit every 6 months and after major life changes.

References

• Have I Been Pwned: Find the Right Plan
• Have I Been Pwned: FAQs
• Google Search Help: Find and remove personal info in Google Search results
• 9to5Google: Google “Results about you” updates (February 2026)
• Hudson Rock: Free Infostealer Monitoring
• LinkedIn Help: Public profile visibility
• Big Ass Data Broker Opt-Out List (BADBOOL)