Post #2375290

2025-06-13 15:23 UTC

One of the best indicators Censys found for attribution is the email address accidentally left in a git commit: % git log commit fa480e80bc5b9e154fad138ef47191032e7ba4dd (HEAD -> main, origin/main, origin/HEAD) Author: Shadow GRT Date: Wed May 7 15:51:15 2025 +0000 Given this is a gmail the first tool we should immediately use is GHunt (https://github.com/mxrch/GHunt) (1/???) #OSINT #OPSECFAIL #CTI #ThreatIntel

Replies (1)

@grey@infosec.exchange 2025-06-13 15:25

The Ghunt output provides us with a few good leads. First it confirms that it's a valid gmail account. Second it provides links to the TA's Google Maps reviews. grey@thruntmachine:~$ ghunt email shadowgamer5628@gmail.com By: mxrch (🐦 @mxrchreborn) Support my work on GitHub Sponsors ! 💖 > GHunt 2.3.3 (🕷 Spider Edition) https://lh3.googleusercontent.com/a-/ALV-UjVyN5P4R9BhUF4W6b8P-zSsuy32A0AsMRd2P9G3VeMGM3JE4HAj [-] Default cover picture Last profile edit : 2025/05/05 09:34:18 (UTC) Email : shadowgamer5628@gmail.com Gaia ID : 112604768676644210605 User types : - GOOGLE_USER (The user is a Google user.) 📞 Google Chat Extended Data Entity Type : PERSON Customer ID : Not found. 🌐 Google Plus Extended Data Entreprise User : False 🎮 Play Games data [+] New token for playgames has been generated [-] No player profile found. 🗺 Maps data Profile page : https://www.google.com/maps/contrib/112604768676644210605/reviews [Statistics] Ratings : 6 [-] Reviews are private. 🗓 Calendar data [-] No public Google Calendar. (2/???) #OSINT #OPSECFAIL #CTI #ThreatIntel

Open ##2375291