<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-cross-platform-identity-correlation
description: >-
  Link identities across social media platforms, forums, and messaging apps
  using username patterns, writing style, temporal activity, profile metadata,
  and behavioral fingerprints. Bellingcat cross-platform OSINT methodology.
domain: cybersecurity
subdomain: investigation-attribution
tags:
  - identity-correlation
  - cross-platform
  - username-analysis
  - behavioral-fingerprint
  - osint
  - bellingcat
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1589"]
---

# Conducting Cross-Platform Identity Correlation

## Overview

Cross-platform identity correlation links accounts across different platforms
to the same individual using username patterns, profile attributes, behavioral
signals, writing style, and temporal activity patterns. Essential for attribution
in investigations spanning multiple online services.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling |
| requests | `pip install requests` |
| sherlock | `pip install sherlock-project` |

## Key Concepts

### Correlation Signals

| Signal | Reliability | Method |
|---|---|---|
| **Username** | High | Exact or pattern matching across platforms |
| **Email** | High | Breach data, registration leaks |
| **Profile photo** | High | Reverse image search |
| **Display name** | Medium | Name variations and transliterations |
| **Bio/About** | Medium | Text similarity analysis |
| **Activity times** | Medium | Timezone and schedule fingerprinting |
| **Writing style** | Medium | Stylometry analysis |
| **Connections** | Medium | Shared contacts across platforms |
| **Content** | Low-High | Cross-posted content, shared media |

### Username Enumeration

```bash
# Sherlock — check username across 400+ platforms
sherlock target_username --output results.txt

# Manual platform checks
# Twitter: https://twitter.com/<username>
# GitHub:  https://github.com/<username>
# Reddit:  https://reddit.com/user/<username>
# Telegram: https://t.me/<username>
```

### Writing Style Analysis (Stylometry)

```
Analyze:
- Average sentence length
- Vocabulary richness
- Punctuation patterns (Oxford comma, ellipsis usage)
- Spelling variants (British vs American English)
- Emoji/emoticon usage patterns
- Common phrases and expressions
- Capitalization habits
- Error patterns (consistent typos)
```

## Quick Reference

```bash
# Check username across platforms
node agent.js username-search --username "target_user" --platforms twitter,github,reddit,telegram

# Compare writing styles
node agent.js stylometry --sample1 text_a.txt --sample2 text_b.txt

# Analyze activity patterns
node agent.js activity-pattern --posts posts.json --timezone-detect

# Build identity profile
node agent.js build-profile --username "target_user" --data collected_data.json
```

## Workflow

```
1. SEED        — Start with known username or identifier
2. ENUMERATE   — Search username across platforms (Sherlock, manual)
3. PROFILE     — Collect profile metadata from each platform
4. COMPARE     — Cross-reference profile attributes (photos, bios)
5. TEMPORAL    — Analyze activity timing for timezone/schedule
6. STYLOMETRY  — Compare writing patterns across accounts
7. CONNECTIONS — Map shared contacts between platforms
8. CORRELATE   — Score correlation confidence per signal
9. DOCUMENT    — Report linked accounts with evidence chain
```

## Detection

```yaml
title: Cross Platform Identity Correlation Detection
id: 1e642d55-24b3-45cb-b543-31b8fdd4854c
status: experimental
description: Detects suspicious activity related to conducting cross platform identity correlation techniques in investigation attribution context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1589
  - attack.command_and_control
falsepositives:
  - Threat intelligence enrichment services querying external APIs
```

## Verification

```bash
sherlock --version 2>/dev/null || echo "Install: pip install sherlock-project"
python3 -c "import requests; print('requests OK')"
node agent.js --self-test
```

## References

- [Sherlock Project](https://github.com/sherlock-project/sherlock)
- [Bellingcat Cross-Platform Investigation](https://www.bellingcat.com/resources/)
- [OSINT Framework — Username Search](https://osintframework.com/)
- [Namechk — Username Checker](https://namechk.com/)
