OSINT On Yourself: A 30 Minute Self-Dox Exercise
A Medium post by aeon-flex (7 min read, published 2026-08-17) laying out a timeboxed self-audit: one username and one recently posted photo in, an estimate of your own exposure out. Four blocks of the clock, then a scorecard. It is the first source here that states the self-osint method as a method rather than shipping a tool that happens to point inward.
What it actually prescribes
Minutes 0–5 — handle to identity graph. Search your main handle logged out, with a single
Google query across the platforms at once:
"voidrane" site:instagram.com OR site:tiktok.com OR site:twitter.com OR site:reddit.com. Then
sweep it through a correlation tool — WhatsMyName is the one named — and write down every old
account that turns up. The claim is that this block is where most leaks are: a 2014 Tumblr, a
Reddit account that mentioned a college, an Etsy shop whose payment name is real. The phrasing is
the sharpest thing in the piece — "if you have been using the same handle for 5 identities, you
have one identity with 5 jobs".
Minutes 5–15 — one photo to a location. Three checks, in order of effort. EXIF first, on the original file if you can get it. Then the background at 200% zoom: outlet shape for the country, street signs and bus numbers, a package label on the desk, a key fob, the view out of the window. Then a reverse image search of a crop of the background alone, not the face, against listing photos and business imagery.
Minutes 15–22 — old handle plus city to a broker file. Query the people-search sites — Whitepages, FastPeopleSearch, Spokeo, Radaris — for the old username, then for real first name + city. Two follow-ups make this block the most original part of the post, and both are covered on data-broker: search your address to see who else is listed at it, and read the brokers' "last updated" field as a tell for whether someone has recently pulled you.
Minutes 22–30 — fix in dependency order. Kill linkability first (rename or retire old handles, move their email and phone to a separate compartment), then change future posting behaviour (a 48-hour delay on anything location-bearing, EXIF stripped on device, backgrounds blank by default), then the home (smart TV mics, speakers, a vacuum that maps and uploads a floor plan), then payment handles, then a deliberate counter-brand.
The scorecard, and what it grades
| Finding | Points |
|---|---|
| Old username that links to a real name | +3 |
| Photo background that places you within 3 blocks | +4 |
| Address on 2+ data brokers | +3 |
| Address reachable via a payment handle or wallet | +5 |
| A broker file refreshed in the last 7 days without you moving | +5 |
0–3 clean · 4–8 "fix in a weekend" · 9+ "fully doxxable from one username and one photo." Re-run every 90 days.
The weights are asserted, not derived — no method, no population, nothing behind the numbers. What they do encode is a preference ranking: the two 5-pointers are the payment trail and evidence of active surveillance, both of which sit outside anything the rest of this spoke's tooling tests for. myip and cover-your-tracks measure a channel; this scores an exposure across channels, which is a different quantity even though both call themselves an audit.
Two claims the corpus should keep
Deleting everything is itself a signal. "Deleting everything after you notice you are being watched is a signal that you know you are being watched." This is the glan-bellingcat-methodology passive-research problem inverted onto the subject: the defensive action is observable, so remediation has to look like ordinary account hygiene rather than a reaction.
The target is not zero leakage. The stated goal is to "leak boring, conflicting, useless data — be visible but expensive to track." That is a cost argument, not a privacy argument, and it is the first thing in the corpus that treats exposure as something to price rather than eliminate.
Where it is thin, and why it is T3 anyway
Every one of the five remediation steps ends in a link to one of the author's paid Gumroad guides — BURNERCONOMICS for compartmentalization, THE FARADAY ROOM for the home, THE WATCHER'S WATCHER for the surveillance tripwires, THE GHOST STACK for payments, THE BRAND THAT WATCHES BACK for the counter-brand. The post is a lead magnet for a product line, so it is graded T3 (first-party, promotional) rather than T4: the method is the author's own and stated in full, but the depth of every section is deliberately held back behind the funnel, and the piece is structured so that each finding produces a purchase.
The evidence is anecdote throughout, all of it unverifiable and all of it the author's own: a full address read off a "10 pixel blurry Amazon label," an apartment building identified from a reflection in a cup of coffee in four minutes. These are presented as things that happened, with no case, date, or subject. They are plausible — geolocation-chronolocation documents the same moves being made and checked — but nothing here is checkable, which is precisely the standard berkeley-protocol and glan-bellingcat-methodology impose on the investigator side and this genre does not.
Two factual claims are also softer than stated. "Most platforms strip EXIF now, but Telegram, Discord, and portfolio sites often do not" — the Telegram case is real and specific (a photo sent as a document keeps its metadata), the general claim is undated and unsourced. And "once one broker links you, they all link you. They resell to each other" is the right shape but is asserted without a single named transaction.
Related
self-osint · data-broker · aeon-flex · username-reconnaissance · geolocation-chronolocation · myip · cover-your-tracks · nothing-private · osint · synthesis