Last updated: September 10, 2025 \u00b7 6-minute read
I always assumed my digital footprint was small. I don\u2019t overshare on social media, I use a password manager, and I\u2019ve been privacy-conscious for years. But last week I decided to stop assuming and start verifying \u2014 by running the same OSINT tools security researchers use on targets against myself.
The results were humbling. 14 tools, 30 minutes, and I found 9 email addresses I\u2019d forgotten about, 17 abandoned accounts, and my personal data on at least 6 data broker sites.
The Starting Point: Where I Looked
I started with the Cyber Detective\u2019s OSINT tools collection on GitHub \u2014 a repo that catalogs over 1,000 services for open-source intelligence gathering. The maintainer describes it as a \u201ccollection of different services, techniques, tricks and notes about OSINT.\u201d It\u2019s the kind of resource that makes you realize how much of your life is indexable.
I also pulled evaluation criteria from Wiz\u2019s \u201c9 Top OSINT Tools & How to Evaluate Them\u201d article, which breaks down what actually makes an OSINT tool useful versus just noisy. Their framework: data breadth, freshness, and actionability.
For the actual scanning, I used Sploitas and a handful of tools from the Cyber Detective collection \u2014 email lookup services, username enumeration tools, and data broker aggregators. The point wasn\u2019t to become a security researcher. The point was to see what a stranger with my email address could find in 30 minutes.
What I Found
1. Emails I Forgot Existed
Running my primary email through OSINT email lookup tools surfaced 9 addresses tied to my identity that I hadn\u2019t used in years. A university email. A throwaway from a 2019 hackathon. Three variations of my name with different providers. Two work emails from previous jobs I\u2019d assumed were deactivated.
2. Abandoned Accounts
The username enumeration tools found 17 accounts across platforms I either barely used or completely forgot about. Old GitHub forks from 2021. A Medium account with one draft. A Fiverr profile. A Stack Overflow account with two answers from college. A Dribbble I signed up for and never touched.
Each one is a potential vector. An abandoned account with a reused password is a foothold waiting to be exploited.
3. Data Brokers
This was the uncomfortable part. Searching my name and email across data broker aggregator tools showed hits on at least 6 different brokers \u2014 sites that buy, compile, and resell personal information. Name, address history, phone number, associated emails, age. All publicly purchasable for anywhere from $2 to $30.
A thread on r/cybersecurity was blunt about the reality: paying services like DeleteMe or Incogni only handle the request loop. They don\u2019t prevent your data from reappearing. One commenter put it well \u2014 \u201cit does not remove your info from the internet, all it does is request that the data brokers delete the copy they have.\u201d
The Cleanup Process
Here\u2019s exactly what I did, in order:
Step 1: Delete abandoned accounts. I went through all 17 accounts and either deleted them or updated the password to a unique 32-character string and removed all personal info. The latter is faster for platforms that make deletion intentionally difficult.
Step 2: Opt out of data brokers. I submitted removal requests to all 6 brokers manually. Most have an opt-out form buried in their footer. A few required email verification or a scan of my ID. The entire process took about 90 minutes spread across two evenings.
Step 3: Consolidate email addresses. I set up forwarding on the forgotten emails to my primary address, then deactivated the ones I could. For the ones tied to accounts I still need (university alumni, bank), I updated the recovery info.
Step 4: Run it again. A week later, I re-ran the same tools. Two of the six data brokers had removed my listing. The rest were \u201cprocessing.\u201d Three abandoned accounts I thought I\u2019d deleted were still showing up in username searches \u2014 the platforms had a 30-day grace period.
What This Means for How I Build
This experiment reinforced something I already believed but now feel more urgently about: privacy isn\u2019t a feature, it\u2019s an architecture decision. Every app I build starts with the assumption that user data stays on the user\u2019s device. That\u2019s why I built PrivacyThink to run LLMs locally, and why every tool in the Lab is designed to minimize data leaving your machine.
If a random person can reconstruct 80% of my digital identity using free tools in 30 minutes, then the tools I build have a responsibility to not add to that pile.
TL;DR
- OSINT tools found 9 forgotten emails, 17 abandoned accounts, and 6 data broker listings tied to my identity
- The Cyber Detective\u2019s GitHub collection (1,000+ services) and Sploitas were my starting points
- Cleanup: delete abandoned accounts, opt out of data brokers manually, consolidate emails
- Data broker removal is a recurring process, not a one-time fix
- This directly connects to why I build privacy-first tools like PrivacyThink and keep experiments local-first
The Projects section has the tools I\u2019ve built with privacy in mind, and the Lab has the ones still in progress. If you haven\u2019t checked your own footprint, do it this week \u2014 not next month.
Not affiliated with Sploitas, OSINT Industries, Epieos, or any data broker mentioned. Tools used: Sploitas, Epieos, OSINT Industries, Cyber Detective\u2019s OSINT collection on GitHub.
Originally published at ansaribilal.com. I write about AI agents, indie builds and developer tooling β more posts here.
Top comments (0)