I read an article that th3j35t3r (hacker alias) had written awhile ago and could not find it again to reference so I will do my best to explain correctly. An anonymous individual tried to dox th3j35t3r. Th3j35t3r replied with a post to his website wherein he unmasked the Anon and explained that he did so by performing forensics on "Google search." He saw that a majority of the queries to Google for "th3j35t3r" came from a single IP address, did his due diligence and identified the person. My question is: how did he do that or what are ways to do that?

TLDR: If I had a term or phrase, what techniques could be used to get info on its queries on search engines like Google?

  • I dont know why whoever downvoted but perhaps you should add a link to your reference article? – Matthew Peters Dec 2 '14 at 19:57
  • @MatthewPeters I'll look again. Not sure why either but could possibly be due to my explanation being poor or not phrasing things best to some. Not exactly sure what the best way to phrase everything would be. – user57594 Dec 2 '14 at 20:00
  • I know that Google Analytics provide a lot of information on the visitors to your website, perhaps that's what the author was referring to as "forensics". – rink.attendant.6 Dec 2 '14 at 20:03
  • Thank you for a lead! I have considered this briefly and it seems like an excellent answer to analyze his site visits. – user57594 Dec 2 '14 at 20:06
  • In the future and in general, I would suggest waiting a few days before accepting an answer. In this case, I would particularly wait to see an answer that has been upvoted (preferably several times) as this shows a kind of 'peer review' from the community (IE dont take my word for it kinda deal). – Matthew Peters Dec 3 '14 at 19:33

What you are referring to what I call a heuristic investigation where the investigator tracks a particular behaviour and tries to tie that to an individual. This technique is used in many fields not just cyber-forensics.

The method your article most likely proposed was somehow obtaining a list of the keyword th3j35t3r correlated with IP addresses that searched for that keyword. I am not aware of any such list publicly available but through legal means, can be obtained by subpena and/or warrants or potentially can be breached by a hacker.

A notable example of what you are looking for is the AOL search log leak where

You can find trends in searches publicly but these are rather anonymous. Some ways to capture specifics would be to setup honeypots such as creating special ads that only target a specific search term (in this case "th3j35t3r"). note: this works well with obscure search terms.

| improve this answer | |

In addition to Google Analytics, Google Webmaster Tools can also provide you with information about words people are searching for to discover your website.

Additionally, certain SEO toolsets such as Raven Tools can provide details about what keywords are driving traffic to a website.

| improve this answer | |
  • 1
    The OP may be look for tools but we should not answer with tools. Instead, the OP is asking for the technique. – Matthew Peters Dec 2 '14 at 21:05
  • Thank you all for the great ideas and answers! This answers my question and has provided great food for thought and research. – user57594 Dec 3 '14 at 18:38
  • @user57594, also there is no need for a thank you comment. If you want/need to leave feedback for future researchers, consider editing your question itself so that the information is there and not buried in a comment. – Matthew Peters Dec 3 '14 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.