<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-social-media-intelligence
description: >-
  Collect and analyze social media intelligence (SOCMINT) including username
  enumeration, profile correlation, geolocation data, and network mapping
  across platforms for OSINT investigations.
domain: cybersecurity
subdomain: osint-recon
tags:
  - socmint
  - social-media
  - username-enum
  - osint
  - profiling
  - geolocation
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  sherlock, maigret, social-analyzer, ghunt, twint,
  holehe, whatsmyname.
metadata:
  mitre-attack:
    - "T1593.001"  # Search Open Websites/Domains: Social Media
    - "T1589.001"  # Gather Victim Identity Information: Credentials
    - "T1589.002"  # Gather Victim Identity Information: Email Addresses
---

# Analyzing Social Media Intelligence

## Overview

Social media intelligence (SOCMINT) involves collecting and analyzing publicly
available information from social platforms. Key techniques include cross-platform
username enumeration, profile correlation, relationship mapping, geolocation
extraction from posts/photos, and timeline analysis. Results feed into target
profiling and social engineering risk assessment.

## Prerequisites

- sherlock, maigret for username enumeration
- holehe for email-to-account mapping
- ghunt for Google account intelligence
- Python 3.10+ with `requests`, `beautifulsoup4`
- Sock puppet accounts for platform access (follow legal/ethical guidelines)

```bash
pip install sherlock-project maigret holehe requests beautifulsoup4
```

## Quick Reference

| Task | Command |
|------|---------|
| Username search | `sherlock username --csv --print-found` |
| Deep username | `maigret username --html -a --timeout 30` |
| Email accounts | `holehe email@example.com --no-color` |
| Google intel | `ghunt email target@gmail.com --json out.json` |
| Batch usernames | `sherlock user1 user2 user3 --csv` |
| Export report | `maigret username --html --pdf -o report` |

## Workflow

### Step 1: Username Enumeration

```bash
# Sherlock — check 400+ platforms
sherlock targetuser --csv --print-found --output results.csv

# Maigret — 3000+ sites with detailed analysis
maigret targetuser --html -a --timeout 30 -o maigret_report

# Social Analyzer — API + profile analysis
social-analyzer --username targetuser --metadata --extract --mode fast
```

### Step 2: Email-to-Account Mapping

```bash
# Holehe — check if email is registered on platforms
holehe target@example.com --no-color

# Check multiple emails
for email in $(cat emails.txt); do
  echo "=== $email ===" >> holehe_results.txt
  holehe "$email" --no-color >> holehe_results.txt
done
```

### Step 3: Google Account Intelligence

```bash
# GHunt — extract Google account details from email
ghunt email target@gmail.com --json output.json

# Extracts: name, profile photo, Google Maps reviews,
# YouTube channel, calendar, connected services
```

### Step 4: Profile Correlation Analysis

Cross-reference findings from multiple platforms to build a target profile:
- Consistent usernames across platforms
- Profile photo reverse image search
- Bio text similarity and cross-links
- Posting time patterns → timezone inference
- Location tags, check-ins, geotagged photos

### Step 5: Timeline and Activity Analysis

```python
# Analyze posting patterns for timezone/behavior
from collections import Counter

def analyze_timestamps(timestamps: list[str]) -> dict:
    """Analyze posting time patterns."""
    from datetime import datetime
    hours = [datetime.fromisoformat(ts).hour for ts in timestamps]
    return {
        "peak_hours": Counter(hours).most_common(5),
        "likely_timezone": "inferred from activity gaps",
        "active_days": len(set(
            datetime.fromisoformat(ts).date() for ts in timestamps
        )),
    }
```

## Detection Opportunities

- Rapid profile access from same IP/user-agent indicates automated scraping
- Platform security teams monitor for bulk enumeration patterns
- Rate limiting and CAPTCHA on login/lookup endpoints detect tools

## Verification

- [ ] Username checked across 400+ platforms (sherlock/maigret)
- [ ] Email-to-account mapping reveals registered services
- [ ] Profile data cross-referenced across platforms
- [ ] Posting patterns analyzed for timezone and activity
- [ ] Findings documented with platform and confidence level
- [ ] OPSEC maintained — sock puppet accounts used appropriately

## References

- [Sherlock](https://github.com/sherlock-project/sherlock)
- [Maigret](https://github.com/soxoj/maigret)
- [Holehe](https://github.com/megadose/holehe)
- [GHunt](https://github.com/mxrch/GHunt)
- [OSINT Framework](https://osintframework.com/)

---
v1.0 | Validated: 2026-03-17
