Finding the site Creator

[Carding 4 Carders]

How to find the site owner by the code on the page​

Using the popular Google Analytics service, web developers collect traffic data (such as country, browser type, and operating system) for users of different domains. To do this, a unique identification number (code) is added to the html code of each page – it is thanks to it that you can trace the connection between different sites. Google AdSense, Amazon, and AddThis work on the same principle.

There are several resources that allow you to perform a reverse search for this unique code and find related sites. Personally, I like working with http://sameid.net (searches not only for Analytics and AdSense code, but also for Amazon, Clickbank, and Addthis code) and with http://www.spyonweb.com. SpyOnWeb is completely free, but only five requests per day are provided for SameID without payment.

sameidnetjpg

Search results for the Analytics code on the SameID site

For more advanced users, I can recommend the NerdyData resource https://search.nerdydata.com/, which searches for matches based on any entered code snippet. The paid version has a very convenient feature for saving search results. But sometimes this site displays the same result several times, and because of this, the search takes a long time.

nerdydata

In NerdyData, you can enter any code and view the search results.

Meanpath.com – a similar site for code search in terms of functionality. the free version displays no more than 100 results.

I advise you to use several tools at once, because they sometimes provide different results. During the experiment, I found out that SpyOnWeb produces fewer results than SameID, and in Meanpath there were two results that neither SpyOnWeb nor SameID found.

You can also enter Analytics or AdSense codes in a Google search – just don't forget to enclose them in quotation marks (for example, “UA-12345678”). This way you will get reverse search results from other tools. In addition, if the site's url or Analytics code was recently changed, you may be able to use Google to find cached results from services using the SameID type and still get to the linked site. To view a saved copy, click on the green downward arrow next to the result.:

googleresult

Checking with the page code
You need to check the results provided by the code search tools. This is done simply-when viewing the code of the website's home page.

To do this, in Firefox, Chrome, Internet Explorer, and Opera, right-click anywhere on the page and select View Source or source (View page code / Source code / View HTML code) from the context menu that appears.

viewpagesource

In the Safari browser, open the Page menu in the upper-right corner of the window and select the same command.

safarisource

After that, a window with the source code will appear – we will search for the Analytics code in it. To do this, select Edit) > Find or use the keyboard shortcut CTRL + F for Windows (similar combination for Mac: ⌘ + F). Enter the following tags in the search bar:

• AdSense: Pub- or ca-pub
• Analytics: UA-
• Amazon: &tag=
• AddThis: #pubid / pubid

ViewSourceAnalytics

Search for Google Analytics code in the page source code

Search for related sites via WHOIS services
From the data about who the domain is registered for, we can extract valuable information about people associated with the site we are interested in. This data includes names, email addresses, mailing addresses, and phone numbers. Of course, it is possible that they are already outdated, but this is not important for us – we are just looking for a link between sites.

There are many WHOIS services available.I recommend that you always check the information you find for several SERVICES. I like https://who.is/, which displays both the site registration history and current data. This is especially useful if the site has recently been switched to anonymous registration.

WHOIS DomainTools

The Domaintools site, which contains the email address and name of the organization that registered the domain – you can use this data to find links to other sites.

There's more http://whois.domaintools.com, where, among other things, the type and version of the server software used on the site and the approximate number of images placed on it are indicated. Whoisology returns not only archived results, but also domains registered at specific email addresses.

Whoisology
Display all domains registered at the same email address on the Whoisology site.

Some WHOIS services do not recognize Cyrillic URLS. To convert an address, use this tool: Verisign IDN Conversion Tool.

Using metadata
The bulk of images and documents uploaded to the web contain metadata – information recorded when creating or editing a file. One of Bellingcat's reporters, Melissa Hanham, has already wrote about how to use metadata for geolocation. We are also interested in how metadata can help us find related sites.

In social networks such as Facebook and Twitter, metadata is deleted automatically, but most other resources don't have it. Metadata is often stored on small websites and blogs.

Two, in my opinion, the most convenient tools for viewing metadata – http://fotoforensics.com/ (only for photos) and Jeffrey’s EXIF Viewer (it also analyzes documents, including PDF, Word, and OpenOffice.)

JeffreysExif ODF

Document metadata in ODF format on the Jeffrey's EXIF Viewer site.

There are many different types of metadata, but we are primarily interested in EXIF, Maker Notes, ICC Profile, Photoshop, and XMP.

Fotoforensics Metadata

Results of metadata analysis on FotoForensics.

They contain information such as the exact version of the image editor. For example, the XMP field "Creator Tool" may contain "Microsoft Windows Live Photo Gallery 15.4.3555.308". The "XMP Toolkit" field often displays similar data, such as "Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27". The main thing is to select the fields that contain specific and detailed information. When analyzing a photo, the model of the camera it was taken with is sometimes displayed (for example, "KODAK DX4330 DIGITAL CAMERA").

JeffreysExif

Of course, millions of different people may have the same version of Photoshop or the same camera, so this information should only be used if there is other reliable evidence, such as the Google Analytics code. However, the document's metadata also contains more specific information, such as the author's name.

XMP Creator

Sometimes the photo metadata may even include a unique camera serial number. Use the following tools to perform a reverse search for this information http://www.stolencamerafinder.com/ and http://www.cameratrace.com/, to find other images taken by the same device.

Saving pages
It often happens that web content suddenly changes or disappears and with it, all the Analytics codes that are important to us. Fortunately, we have the ability to save web pages. It is preferable to save not only the sites you study, but also search results from SameID and other services.

For quick and convenient saving, use the Internet Archive Wayback Machine. Once archived, the page content cannot be changed, so it is unlikely that anyone will challenge its authenticity.

Wayback Archive Save Page

In addition, the Wayback Machine inserts the date and time into the code of the archived page, so that this tool is trusted even by criminologists.

Wayback Archive Date Time Stamp

The Website service is similar to the Wayback Machine, but here the user is allowed to edit some data. To view the archive page code, you will need to use View Frame Source instead of View Source (this Frame in Firefox). But this service also has advantages – it sends the addresses of archived pages to your mailbox. There is also Archive.is, it is very convenient for saving profiles from social networks.

There is one catch – all these tools allow you to manually archive only individual pages, but not the entire site. In addition, they will not work if the resource is protected from search robots or automatic copying of content in order to place it on other sites. In this case, it is best to save individual pages to your computer and / or take a screenshot. I use the free web Page Saver tool from the Magnet Forensics site, although in some cases the Windows Snipping Tool and DropBox are also suitable.

In addition, it makes sense to manually add the page to the Google index. Then it is more likely to be saved to the Google cache, where you can then find it.

Graphical display
If you study a large group of sites, it's easy to get confused about the links between them. For convenience, organize them into a diagram.

The free yEd Graph Editor application (for Windows, OS X, and Linux operating systems) is a very convenient tool for creating both simple and complex graphs and diagrams. To create a diagram, simply drag the icons to the desired location and indicate the relationship between them.

Analytics IDs yEd

First, enter all the elements that you found: site addresses, names, organization names, and unique codes. If you've learned something new, don't forget to add this information to the chart. The yEd app has icons that represent computers, files, people, and so on, so you can get creative.

The selection of charts and graphs is quite large. In this example, I used the Circular and BCC Isolated charts to display sites in a circle, each of which is linked to the Analytics code located in the center.

Conclusions
In this article, we looked at open sources of information and tools that show you how to find the site owner and allow you to find links between sites that at first glance have nothing in common. We also found out that to ensure that no one doubts the results of our investigation, we need to look for confirmation in other sources and always save the pages we found.