Cross-Platform Correlation and Account Linking

Overview

Cross-platform correlation takes the confirmed accounts from username enumeration and connects them into a single unified profile. The goal is to extract every additional identifier each platform exposes, then use those identifiers to find more accounts, verify the subject's identity, and build a complete picture of their digital presence.

Automated tools find where accounts exist. This step is mostly manual. It requires reading each profile carefully and cross-referencing what each one reveals against the others.

What to Extract From Each Account

Visit every confirmed account and record the following where present:

• Display name and any name variations

• Bio text, especially location claims, employer mentions, or linked handles

• Profile photo and banner image

• Linked accounts or website URLs in the profile

• Email address if publicly visible

• Join date or account creation date

• Posting language and timezone indicators from post timestamps

• Follower and following lists on platforms where these are public

• Tagged locations in posts

• Mentioned usernames in posts and replies

Do not limit extraction to the profile header. Post history, replies, and comments frequently contain information the subject did not intentionally make visible in their profile.

Profile Photo Correlation

The same profile photo used across multiple platforms is one of the strongest identity links available. Run every distinct profile photo through reverse image search to find other accounts using the same image and to check whether the photo appears elsewhere under a different name.

Use multiple reverse image search engines since coverage differs significantly between them:

• Google Images

• Yandex Images (strongest for facial recognition against social media)

• TinEye (best for exact image match history)

• Bing Visual Search

If the photo appears on a platform not found by username enumeration, that is a new account to investigate. If the photo appears under a different name, that name becomes a new search seed.

Bio and Writing Pattern Analysis

Subjects often reuse identical or near-identical bio text across platforms. Copy the bio from one confirmed account and search for it verbatim in quotes. This surfaces accounts on platforms that automated tools may not cover.

Writing style and vocabulary are also useful when account ownership is disputed. Consistent spelling habits, punctuation patterns, and phrase reuse across platforms support attribution even when usernames differ.

Linked Accounts and Platform Bridges

Many platforms allow users to link or verify other accounts directly in their profile. These explicit links are the most reliable correlation signal available:

• Twitter and Mastodon allow link verification in the bio

• Keybase publicly maps verified accounts across platforms and is searchable

• GitHub profiles frequently link to personal sites, Twitter handles, and email addresses

• Reddit profiles sometimes list linked social accounts in the bio or post history

• LinkedIn often contains personal email addresses, GitHub links, and portfolio URLs

Search Keybase directly for a username if the subject is technically inclined:

The response includes all accounts the subject has cryptographically verified through Keybase, which is a reliable link since verification requires account ownership.

Timestamp and Timezone Analysis

Post timestamps reveal activity patterns that can narrow down a subject's timezone and, in some cases, work schedule or country of residence. Collect timestamps from multiple platforms and plot activity windows. A subject who posts consistently between 09:00 and 23:00 UTC+1 and goes quiet on local public holidays is providing strong location signals even without explicit location disclosure.

Building the Link Graph

As correlations accumulate, maintain a structured record rather than working from memory. A simple spreadsheet with one row per account and columns for platform, username, display name, email, linked accounts, and notes is sufficient for smaller subjects. For complex subjects with many accounts, a link analysis tool like Maltego or a graph database gives a better overview of connections.

Each new identifier found becomes a new search seed. An email address found in a GitHub profile can be searched in breach databases, used for email enumeration across platforms, and checked against public records. A phone number found in a LinkedIn profile opens phone number intelligence workflows. The correlation process is iterative, not linear.

Archiving Before Proceeding

Account content can be deleted at any time, particularly if the subject becomes aware of the investigation. Archive every significant profile and post before moving further. Use tools like waybackurls, the Wayback Machine's save feature, or httrack for full page captures. Screenshot critical content as a minimum.