Social Media OSINT: Timezones From Timestamps, Networks From Replies
people think they are anonymous online because they used a fake name. then they post every day at the same local lunchtime, reply to the same six friends, and use a hashtag only forty people on earth use. a username is a disguise. a posting pattern is a fingerprint. social media osint reads the patterns people cannot help leaving.
step 1: read the profile, not just the bio
the metadata around posts says more than the posts. account creation date, display name history, linked accounts, the apps posts are made from (“via” tags where available), profile and banner images (reverse-image them), and the handful of “about” fields people fill in without thinking. one consistent profile photo reused across platforms is a cross-platform pivot by itself.
step 2: when do they post? (timezone from timestamps)
this is the classic and it is beautiful. collect the timestamps of a public account’s posts, bucket them by hour of day in utc, and plot a histogram. humans sleep. the dead zone in the histogram is their night, which pins their timezone within an hour or two even if they never state it.
layer on day-of-week (weekday lunchtime posting suggests a desk job), and sudden shifts (a week where the pattern slides six hours usually means travel). it is low-tech, hard to fake consistently, and it quietly contradicts a lot of “i’m posting from london” claims.
step 3: who are they, really? (network mapping)
you are the company you keep, and on social media that company is public. build a graph of who an account replies to, mentions, and shares, and clusters appear: the work crowd, the hometown crowd, the hobby crowd. the people they interact with most, especially mutuals, are the strongest links to a real identity.
niche hashtags and small communities are especially telling: a hashtag used by one conference, one town’s running club, or one fandom narrows a person fast. export the graph (gexf) into gephi for the visual, and the dense cluster in the middle is usually the answer to “who is this, actually.”
the profiling flow
- profile metadata and reused images for cross-platform links
- timestamp histogram for timezone and work/sleep rhythm
- interaction graph for the real social network and likely identity anchors
- niche hashtags and small communities to narrow location and affiliation
- corroborate across platforms, never trust a single signal
what defenders can do
- audit your execs and brand accounts: what does a posting-pattern and network map reveal about your leadership? that is a spear-phishing and physical-security brief.
- train against oversharing: real-time location posts, conference check-ins, and “back to the office monday” posts are recon gifts.
- separate contexts: different handles and photos for work and personal breaks the cross-platform pivot.
- watch for impersonation: the same techniques find lookalike accounts targeting your brand or staff.
sloth take
the fake name was never the weak point. the weak point is that people are creatures of habit who post at lunch, reply to their real friends, and cannot resist a niche hashtag. point this at your own org to see what leaks, teach your execs to post less about their monday commute, and leave private strangers alone. the technique does not care about the target; you have to.
sources
- Bellingcat and OSINT community guides on social media analysis and network mapping
- Gephi for interaction-graph visualization
- Platform terms of service and applicable scraping and privacy law
- Lab artifacts generated on-box 2026-10-17 (synthetic export and terminal captures)
