WEBVTT

00:01.440 --> 00:08.000
In this video, we're going to take a look at the new challenge that I put up for the course.

00:08.560 --> 00:16.880
Now in this revised version, you're going to blue Sky looking at Karen Neo at Blue Sky.

00:18.800 --> 00:23.600
And the scenario is, this person's harassing your client, and your client would like to know who it

00:23.600 --> 00:24.040
is.

00:25.760 --> 00:31.240
And essentially what your job is, is to find out.

00:31.360 --> 00:33.400
Is there blue sky name accurate?

00:33.440 --> 00:35.560
If not, who are they really?

00:36.040 --> 00:37.240
What's their occupation?

00:37.240 --> 00:39.000
What city state do they live in?

00:39.520 --> 00:42.640
What school do they go to, and what's their phone number?

00:43.560 --> 00:50.160
Now, again, this is all completely fictional scenario and the person that you're investigating, blue

00:50.160 --> 00:55.640
Sky is a account created because I don't believe in actually doxing anyone.

00:56.560 --> 01:03.440
Uh, in unmasking a criminal is one thing.

01:03.620 --> 01:06.900
doxing someone in real life is pretty, pretty different.

01:07.540 --> 01:12.740
And as a matter of fact, this actually reminded me of one of the early open source intelligence certification

01:12.740 --> 01:13.540
I went for.

01:14.900 --> 01:26.700
The test was to unmask a very real person and give the the person that created the certification test

01:27.340 --> 01:28.420
that information.

01:28.420 --> 01:37.620
And it wasn't a criminal, it was actually a person that had a alias that went unmasked and exposed

01:37.860 --> 01:38.740
criminals.

01:39.540 --> 01:43.740
Uh, so I didn't think that was very ethical.

01:43.740 --> 01:49.540
So that's why whenever we do something like this, it's it's always a fictional scenario, fictional

01:49.540 --> 01:50.020
person.

01:50.020 --> 01:57.380
Because I don't believe in, um, essentially doxing people again, especially if it's someone that's

01:57.380 --> 02:01.380
really not doing anything, um, illegal.

02:01.380 --> 02:08.090
So again, we're going back and we're going to take a look at this blue sky account here.

02:08.090 --> 02:09.690
And that's going to be your starting point.

02:09.730 --> 02:13.010
Now we're going to go over a possible solution.

02:13.010 --> 02:19.170
I'm going to say possible because there's generally different ways to tackle a problem and get the solution.

02:19.170 --> 02:20.370
So let's take a look.

02:21.970 --> 02:24.290
So this is the blue sky account here.

02:25.690 --> 02:28.730
And we can see that they have their following one person.

02:28.730 --> 02:29.410
They have one post.

02:29.410 --> 02:30.650
They have three followers.

02:30.850 --> 02:32.650
Let's actually take a look who they're following.

02:32.690 --> 02:34.410
User does not have any followers.

02:34.730 --> 02:35.610
Well that's interesting.

02:35.610 --> 02:36.850
It says three followers.

02:37.730 --> 02:41.850
It says they're following someone which is actually the blue sky account.

02:42.730 --> 02:44.330
So that doesn't really count.

02:44.330 --> 02:48.530
And you can see that they posted three months ago out for a walk around town.

02:49.650 --> 02:52.330
Now there's no other information on here.

02:52.330 --> 02:56.410
So what I would normally do is save this image.

02:56.770 --> 03:01.250
And we could do a reverse image search on this to kind of get see if there's more information.

03:01.410 --> 03:05.610
Maybe what they're saying they want to walk around town.

03:05.610 --> 03:08.210
So this is probably within their area.

03:08.410 --> 03:14.470
So we could use things like Google image, reverse searches, Bing, Yandex, Tineye.

03:15.590 --> 03:22.910
We could use things like the internet, not the Internet Archive, rather the ChatGPT, for example,

03:22.910 --> 03:28.830
or or Google's AI and say, hey, you know, where's where's this picture from?

03:28.870 --> 03:35.350
And it it'll generally give us a rough idea of where that image was taken.

03:36.070 --> 03:40.710
Now, this particular route really doesn't come up with anything too useful.

03:40.710 --> 03:43.110
So let's take a look at what else there is.

03:43.350 --> 03:46.110
Well, they have this link here minds.com.

03:46.470 --> 03:46.830
Hmm.

03:47.470 --> 03:47.870
Okay.

03:47.870 --> 03:51.470
Well let's go to that minds.com and see where that takes us.

03:52.350 --> 03:54.150
Uh, that actually takes us here.

03:54.710 --> 03:55.710
Minds.com.

03:56.350 --> 03:57.310
Coroneo.

03:59.230 --> 04:01.110
And we can see this username here.

04:01.590 --> 04:01.990
So.

04:04.030 --> 04:05.870
Generally, I will take this username.

04:05.870 --> 04:14.130
I'll feed it into things like, uh, Sherlock, a whole heave whatnot, and start doing a username search

04:14.130 --> 04:15.930
and see if that where else that was used.

04:17.610 --> 04:20.250
Also going to go through here.

04:20.250 --> 04:23.330
And we're going to start taking a look at what they have posted here.

04:23.370 --> 04:24.410
Well let's see here.

04:25.050 --> 04:27.690
They have this strikingly page here.

04:27.690 --> 04:29.170
We'll take a look at that moment.

04:29.290 --> 04:32.210
And they also have this QR code.

04:33.290 --> 04:35.890
So I'm going to I'm going to save this link.

04:35.890 --> 04:37.650
And I'm going to copy that QR code.

04:37.650 --> 04:40.090
And I'm going to see where that QR code goes to.

04:42.010 --> 04:46.090
And I just use a QR code scanner.

04:46.810 --> 04:52.490
So I have that uploaded and it spit out this which looks strikingly like a Bitcoin address.

04:53.170 --> 04:59.650
So taking that Bitcoin address I'm going to feed it into something like Betreff Bitcoin who's who blockchain

04:59.650 --> 05:00.890
explorer whatnot.

05:01.130 --> 05:01.850
Put it in there.

05:01.850 --> 05:05.490
And sure enough yes this is actually a Bitcoin address.

05:06.050 --> 05:09.530
And there's no balance no transactions.

05:10.410 --> 05:14.010
So there's nothing that I could actually start tracking through.

05:14.010 --> 05:16.280
So that looks like that's a dead end.

05:17.200 --> 05:23.600
And don't be discouraged if you end up with coming up with some dead ends, because the truth is, you're

05:23.600 --> 05:28.680
going to almost definitely run into some roadblocks and dead ends.

05:28.720 --> 05:34.880
The thing is, uh, we mark that down and we pivot and look for another angle.

05:36.640 --> 05:37.000
Okay.

05:37.040 --> 05:38.960
So that's that's a no go.

05:40.080 --> 05:40.960
Uh, going back here.

05:40.960 --> 05:42.600
Well, there's a strikingly page.

05:42.600 --> 05:43.680
What the heck is this?

05:44.160 --> 05:45.120
Well, let's go there.

05:46.120 --> 05:46.760
Okay.

05:46.800 --> 05:52.680
Well, looks like they have another page, and they're they're listed as a homemaker.

05:53.120 --> 05:54.240
We can see their image here.

05:54.240 --> 05:55.440
I could do save this.

05:55.440 --> 05:56.760
Do a reverse image search.

05:57.680 --> 06:06.360
I can look at the metadata for these images, but almost every site will scrub metadata from it.

06:06.360 --> 06:08.800
So it's probably not going to find anything useful there.

06:08.840 --> 06:10.120
Well let's scroll down here.

06:11.080 --> 06:13.240
And they have a mark Twain quote here.

06:13.280 --> 06:14.320
And about them.

06:15.400 --> 06:16.680
Uh, please pardon the mess.

06:16.680 --> 06:18.780
I'm in the process of setting up a new page.

06:18.780 --> 06:19.740
How exciting.

06:21.140 --> 06:22.820
Uh, specialties.

06:23.900 --> 06:24.540
Cooking.

06:24.540 --> 06:25.140
They have it.

06:25.460 --> 06:27.420
And there's their crypto address again.

06:28.940 --> 06:32.260
Uh, there's a address here.

06:32.300 --> 06:34.220
Los Angeles, there's a telephone number.

06:34.220 --> 06:36.020
There's a email address there.

06:36.540 --> 06:37.060
Okay.

06:37.100 --> 06:37.500
Well.

06:38.020 --> 06:38.380
Hmm.

06:39.780 --> 06:47.060
Let's take a look at if there's any thing that they posted that may be archived.

06:47.500 --> 06:55.460
So I would take this blue sky address and put it into something like, uh, Wayback Machine, for example.

06:56.140 --> 07:02.500
I put that in here and we could take a look and doesn't look like that got archived.

07:02.540 --> 07:05.220
Okay, um, let's try this.

07:05.220 --> 07:06.300
Uh, mine's page.

07:07.020 --> 07:07.460
It's mine.

07:07.460 --> 07:09.580
Page was archived.

07:10.340 --> 07:11.340
Put that in there.

07:12.660 --> 07:14.740
Doesn't seem to be archived there either.

07:15.340 --> 07:16.940
Well, let's try this one.

07:16.940 --> 07:18.460
The strikingly page.

07:20.660 --> 07:23.040
We'll just paste it in here.

07:24.080 --> 07:26.160
And this was archived.

07:27.560 --> 07:27.880
Okay.

07:27.920 --> 07:36.440
It looks like March 27th, 2025, 1951 and 50s.

07:36.480 --> 07:40.840
Let's take a look at that one snapshot and see what we can find.

07:41.080 --> 07:41.680
Okay.

07:42.640 --> 07:44.680
Well now we have some a different name.

07:45.680 --> 07:47.160
I'm going to just minimize that.

07:47.320 --> 07:49.400
Doctor Agnes Schultz.

07:50.080 --> 07:50.320
Uh.

07:53.160 --> 07:54.320
Prosthodontist.

07:54.480 --> 07:57.040
I might be pronouncing that wrong.

07:58.160 --> 08:03.520
Okay, well, there's a different image there, so I would do a search on that name.

08:03.800 --> 08:10.800
I would do a search on the, uh, on the job in addition to the old name, to just to see if I could

08:10.800 --> 08:12.320
find more information on it.

08:12.800 --> 08:13.840
And we can see.

08:13.880 --> 08:15.400
Oh, well, it's interesting.

08:15.400 --> 08:20.480
It has the same, uh, Mark Twain quote, but it has a different image there and a different name and

08:20.480 --> 08:22.520
different job.

08:24.350 --> 08:25.030
Education.

08:25.030 --> 08:26.910
University of Western States.

08:29.310 --> 08:32.470
Looks like experience specialties.

08:33.070 --> 08:34.190
Scroll down to here.

08:34.910 --> 08:36.830
Same address, different phone number.

08:36.830 --> 08:38.870
And there's an email address here.

08:39.750 --> 08:43.310
So it looks like this person had this site here.

08:43.310 --> 08:47.870
And then they changed it later to this.

08:49.310 --> 08:49.790
So.

08:52.270 --> 08:53.550
Let's get back in there.

08:57.670 --> 09:00.790
So this is in fact the person that you are looking for.

09:01.150 --> 09:03.190
That's your name occupation.

09:03.510 --> 09:07.630
Scroll down here address telephone number email address etc..

09:08.030 --> 09:12.350
So again this was a scenario.

09:12.350 --> 09:15.310
So you're taking different things that you learned through the course.

09:16.030 --> 09:19.710
Not everything is going to be is going to work every time.

09:19.990 --> 09:21.750
But it's good to cover your bases.

09:21.750 --> 09:24.470
So hope you enjoyed this one.

09:24.670 --> 09:27.670
Thank you so much for watching and I'll see you in next video.