digest
Short Summary
Main recommendation: Audit your own digital footprint with these 10 OSINT tools, then shrink it by closing old accounts, retiring reused usernames, using email aliases, and locking down privacy settings. The tools only collect information you already made public, so you are the real defense. Several of the tools are described as checking whether an email or username is exposed, then delete or change what you find.
Key Points
- The 10 tools covered, in the order the video counts them down from 10 to 1: Sherlock, Holehe, Epieos, WhatsMyName, GHunt, theHarvester, SpiderFoot, Dehashed, IntelX, and Recon-ng.
- Username reuse links accounts together; Sherlock checks over 400 sites for a handle, while WhatsMyName checks over 700 platforms and focuses on where a name exists but goes unused.
- Email exposure is a major risk: Holehe checks registrations on over 120 sites without needing a password, and Dehashed searches billions of breach records.
- Google accounts can reveal more than expected: Epieos can surface public Google Maps reviews and GHunt can show public calendars, Drive files, and YouTube channels.
- The speaker frames all these tools as collectors of already-shared data rather than hacking tools, so privacy settings and cleanup matter more than any single product.
Details Worth Noting
- Concrete instructions:
- Run Sherlock on your own username and count how many profiles appear. Delete the ones you no longer use.
- Use different usernames for different platforms so one handle does not open every profile.
- Run your email through Holehe to find forgotten accounts, some of which may still hold payment info. Delete them.
- Use email aliases such as SimpleLogin or Apple's Hide My Email, giving each site a different address so one leak does not expose the rest.
- In Google account settings, turn off public reviews, check what information is shared publicly, and review YouTube history settings.
- Consider a separate Google account for public or throwaway signups, separate from work and sensitive use.
- Run WhatsMyName to get the full list of sites where your name is taken, then delete, change, or lock down each one.
- In Google privacy settings, lock down your calendar, Drive, and YouTube visibility.
- For a personal domain, use a contact form instead of listing your email publicly, and check what emails theHarvester can find.
- Run SpiderFoot on your own email or domain, then delete old accounts, remove personal info from public profiles, and opt out of data brokers.
- Check your email on Dehashed. If it appears in a breach, change the password on every site where you reused it.
- Use a password manager such as the free Bitwarden to generate unique passwords, and enable two-factor authentication.
- Run IntelX on your email; if data appears, change passwords, freeze your credit, and set up identity monitoring.
- Use Recon-ng on your own domain or email, then switch to Signal, use a VPN, turn off phone geotagging, review social media privacy settings, delete old accounts, and opt out of data brokers.
- The speaker says SpiderFoot's original project went dormant around 2023, but a community fork has revived it.
- IntelX's most valuable data sits behind a steep paywall; the free tier is limited.
- Holehe's biggest modules, such as Twitter and Instagram, have broken in recent years, though it still works on dozens of other sites.
- The speaker reports finding a 2007 MySpace profile with a real name, city, and photo through IntelX, showing old data can persist for years.
Bottom Line
Most of this exposure comes from your own accumulated accounts and public settings, so cleaning them up is the most effective step; the tools only reveal what is already out there.
