Writing research: how to detect if someone is searching for you online

October 12, 2022 10:28 AM

In the book I'm writing at the moment, I need to set things up so that one character has a way to find out that another character is searching for information about them online.

I have two characters. Ray, and Dipshit (placeholder name till I come up with something better 😐)

Ray needs to find out who Dipshit is. Somehow, whatever she does while searching makes Dipshit aware of her, to the extent that he knows who she is and can hack her computer.

The only way I've come up with so far is that Dipshit sets a a Google alert for specific terms, that only people who are looking for him would use.

Then when Ray asks a question on a forum with these terms, Dipshit is alerted and he can join the dots of her forum profile to trace the information he needs to hack her.

The problem with that is that while Ray isn't more than usually knowledgeable about tech and online privacy, posting a question that's obviously about Dipshit in a way that can easily be linked to her real identity seems just a bit too careless to be believable.

What other ways could Dipshit use to become aware that he's being snooped upon, and find the identity of the snooper?

posted by Zumbador to Computers & Internet (16 answers total)

LinkedIn will tell people when someone is browsing their profile, which is a way this can happen.
posted by wesleyac at 10:33 AM on October 12, 2022 [7 favorites]

LinkedIn provides information on "who searched you" for certain levels of paid account and/or depending on privacy settings.

I believe Facebook will show you "People you may know" that includes people who have been searching you or looking at your stuff without friending you. It does not mark these people in any way that lets you know they are random stalkers - they are mixed in with random friends-of-friends and the like, but if you paid close attention to this category you might notice odd people showing up.
posted by Mid at 10:36 AM on October 12, 2022 [1 favorite]

If she finds his phone number or email and saves it in her contacts, and her Facebook or Instagram (or for all I know LinkedIn) is set to add/suggest people from her contacts, those services will suggest her as a friend for him even if he doesn't have that setting on. I isolate my social media severely but still get RL acquaintances suggested in that way. Someone new popping up may alert him enough to google her and use that service to social engineer her into being hacked.
posted by I claim sanctuary at 10:39 AM on October 12, 2022 [2 favorites]

I definitely agree that social media can be very creepy about stuff like this, but it sounds like Ray doesn't necessarily make it as far as his actual profiles? However, if Dipshit is aware of the possibility of someone like Ray searching for him, he could actively bait something in an innocuous-looking way. Say he sets up what looks like a highschool reunion page that happens to include some useful tidbits, and Ray finds that via a regular search engine but then Dipshit can put together her unique terms and cookies she might have blindly hit "accept" on to do something. Or he even makes it so it seems like there's a third party to contact who might have more information, but actually it's him and he can social engineer the details he needs from her directly in conversation.
posted by teremala at 10:40 AM on October 12, 2022 [3 favorites]

Could Dipshit host a dummy website, separate from his own site, that logs the IP address of visitors? My thought process here is that most people looking for basic information about a person would first look on big sites like Facebook or LinkedIn (or, if they're notable enough, Wikipedia), and then on the "official" personal site. If they start going down the search rankings, that's an indication that the publicly-available information isn't satisfying their curiosity, and whoever's looking at like, page 3 of search results is probably not doing so because they want to know if it's the same guy they went to high school with twenty years ago. It should be a simple site, plain text, with his name and a few specific keywords (probably the same keywords in Dipshit's Google alert). No links, no images.

Alternatively, he could use a dedicated burner phone number/email address to register his domain name. That way, any incoming calls/emails could be traced to someone who was doing a WHOIS lookup.
posted by kevinbelt at 10:41 AM on October 12, 2022 [2 favorites]

Back in the 2000-ish times, if Ray had a website, if they were browsing their referrer logs, they could see what search terms were bringing people to their site and from what IP address. Sometimes those were just random-seeming numbers, other times they were resolved into URLs that could tell you something (like if the searcher were at a university, you’d see harvard.edu.) Ray could make some good guesses, if Dipshit were in Mankato, MN, and their search logs for “Ray Rayerson” were resolving to the University of Minnesota at Mankato.
posted by chesty_a_arthur at 10:45 AM on October 12, 2022 [1 favorite]

I haven’t looked at raw search logs in many many years, so I don’t know whether the above is still plausible.
posted by chesty_a_arthur at 10:47 AM on October 12, 2022 [1 favorite]

I check my search logs and it’s still possible! Could make guesses based not just on IP but on device, browser. Or if Dipshit came to your WordPress site and visited a specific landing page (“About Ray”), or typed something specific into the search bar, then Ray could go through the logs and cross-index that visit to one of the above.

I’m also thinking of the Vardygate scandal here in the UK in which an athlete’s wife was able to pinpoint a nemesis by making certain information exclusively available to them on social media. Maybe something similar could be done with making a specific honeypot webpage only accessible to a certain IP.
posted by johngoren at 12:16 PM on October 12, 2022 [1 favorite]

If Dipshit were a publishing academic, to my knowledge both academia.edu and researchgate will send him notices of who searched for him and with a paid subscribtion he can get details.
posted by 15L06 at 12:53 PM on October 12, 2022 [1 favorite]

honeypot forum would be the way:
dipshit comes to site from the search criteria
is asked to sign a doc on OneDrive or GDocs to join the community
that itself is the trojan to get password
from a fake login or a download that gains access to the physical computer.
posted by k3ninho at 1:35 PM on October 12, 2022 [2 favorites]

For a fictional but realistic portrayal (in that it doesn't strain credulity, not that specific social networks do or don't allow this currently), I'd say a generic social media site run by a large fictional company. Certainly in the more trusting days of the internet, it wasn't uncommon to have a 'who's actively browsing' widget of things like forums, and really, it's not hard to see how some deluded techbro might think it's a good idea to bring things like search and login tracking forward.

I would explicitly warn against using the name of an actual company or product in your story unless you enjoy completely avoidable lawsuits.
posted by Aleyn at 2:24 PM on October 12, 2022 [1 favorite]

Perhaps Ray's internet sleuthing leads her to a printed book or article whose contents (not available online) she suspects will help her find out Dipshit's identity. So she buys the only copy for sale online. Unfortunately, the seller is of course Dipshit, who now has her name and mailing address.

Slight variation: she posts on a forum that she's looking for a copy of said book or article, and Dipshit (who has a Google alert) helpfully offers to mail it to her.
posted by eponym at 5:25 PM on October 12, 2022 [3 favorites]

I'm not sure why no one else has mentioned this yet but on Instagram, you can see who's watched the stories you posted. So, if Dipshit posts IG stories and Ray knows this but isn't very careful (e.g.: using a burner IG account or something), Dipshit could see that Ray is watching his stories. For a more sophisticated take on this, Dipshit could establish a number of fake IG profiles designed to lure in people who are looking for him (e.g.: not just fake profiles for himself but maybe even fake relatives or friends, seeding profiles with certain keywords in the bio, etc...). So, even if Ray is aware that she shouldn't look at Dipshit's own profile using her real IG account, she might be less careful if she's just searching for certain keywords/hashtags/whatever and seeing what shows up.
posted by mhum at 5:51 PM on October 12, 2022 [1 favorite]

If Dipshit has a relatively unique name (or other unique information someone would use to search for them) they can set up a personal web host called uniquetext.com that includes the unique text and a random photo. Google will index it and someone searching for the unique text will almost certainly click on the link. Their web host will log any visitors.
posted by Tell Me No Lies at 6:03 PM on October 12, 2022 [1 favorite]

A previous real world parallel is how Link Machine Go discovered that someone at Associated Newspapers had maybe pieced together the real identity of blogger Belle de Jour, and so was able to alert her before the story came out.
posted by fabius at 5:17 AM on October 13, 2022 [1 favorite]

I thiiink that if you search for someone by name on facebook, esp. if you click to look at their profile, that person is then likely to then see you in their automated friend suggestions, even if you don't send them a friend request.

So if Ray already knows Dipshit's name and searches for them on fb, that might flag Ray up.
posted by penguin pie at 6:57 AM on October 13, 2022 [1 favorite]