• Chris

Connecting the dots - social engagement clusters on Facebook & Instagram

Identifying real associates of an individual can be challenging in the world of social media because there are so many platforms to track and a lot of them don't restrict who can follow you or who you can follow by default (i.e. Twitter & Instagram). What this means is that friends lists and followers/following lists do not paint an accurate picture of real associates.


One method that can be used to help in this situation is analysing social engagement metrics to work out clusters of individuals. What does that mean? - essentially capturing the likes or comments of posts that a user makes and clustering users into groups based on the frequency of their engagement with a user.


I've found that analysing even as little as 6 photos from a user on Facebook to identify who routinely likes the photos can be fairly accurate in identifying common circles of friends. Sometimes when analysing fake profiles it can reveal the true person behind the profile because they demonstrate poor trade-craft and routinely like the fake account from their real account in an attempt to generate interest. This ends up putting them at the top of the list.


What & Why?


How? - The concept explained


We'll work through the concept first and then the specifics on how to do it on each platform later in the post. This will establish the foundations as the process is repeatable on just about any social media platform that users engagement metrics such as likes & comments.


High level process:


Using the concept above an easy and repeatable method I've found is to simply:

  1. Scrape the likes & comments of a post and put the results of the users names in a single column in a spreadsheet.

  2. Repeat this for as many photos/comments as possible and keep adding the names to the list to create a single long list of names which will contain a lot of duplicates.

  3. We leverage these duplicates to calculate how often the same user shows up to identify clusters of routine/common associates.

Special formula: To calculate how often a name shows up from the first column we simply put this formula in the 2nd Column's 1st Cell and duplicate it down: "=COUNTIF(A:A, A1)"


We can simulate this to get started by writing a list of names in a spreadsheet in column A and then putting out special formula in column B.


You should end up with the spreadsheet looking like this:


then this



You will notice that it has calculated how often each users has appeared and "John Doe" and "Andrew Blogs" have shown up twice. You can simply filter these in Excel or import them into Maltego, CaseFile, Gephi or other link diagram applications.


Maltego example: - note that when done at scale you can quickly cluster individuals based on how often they "engage" with the target.


Now we have the concept established, lets look at Facebook and Instagram specifically.


Facebook

I've outlined the process below using manual techniques so it isn't reliant on tools. You can always use tools for efficiencies but Facebook is focusing more on privacy nowadays so understanding manual approaches to accessing data is becoming increasingly important.


A little known sub-domain on Facebook is the static HTML version of their site at https://mbasic.facebook.com. In the process below we are accessing this particular site because you can simply copy the search results from the page and it will paste nicely into a spreadsheet without formatting changes.


Once you have identified the photo of interest (and you will process as man as possible) you will see a link labeled "See More" - click this and then modify the URL to change 'limit=10' to 'limit=xxxx' where xxxx is the total number of likes you want to view a time. This is the same concept as setting the "display 100 results per page" for tables etc.



You should end up with a spreadsheet like this:

You will notice I have put the =COUNTIF formula in the D column instead of the B column. Don't stress, just modify the A:A,A1 from the original part of this post to C:C,C1 - it should logically just slide across.


Importantly you will see the green box that we have identified that user as having 3 engagements and is the highest-engaged user. We might pivot from this bit of insight to see if they are truly associates.



Instagram

A great writeup on Instagram searching was done by @Technisette (https://osintcurio.us/2019/07/16/searching-instagram/) which provides details on how to use the Instagram Helper tools but essentially just download the tool from here the Chrome store or here: https://chrome.google.com/webstore/detail/helper-tools-for-instagra/hcdbfckhdcpepllecbkaaojfgipnpbpb


What we are going to do is essentially use a tool to conduct the same activity we went through in the Facebook section but at a greater scale. Once you analyse the user of interest we are looking to sort the columns based on the number of likes.


We can export this and conduct the same cluster analysis but the simple process is outlined below:


What is this good for?

There are many use-cases for this but lets look quickly at how it can help in a missing persons case:

If you know a close associate of the missing person you could use the technique on their profile to illuminate:

  • Key people to talk to from an identified associates list to help find the person or identify other pivot points to investigate

  • Possibly identify a fake profile used by the missing person to engage with “friends” by looking at the friends engagement clusters for patterns or profile images


You could use the technique to possibly understand:

  • Social networks based on engagement to identify confirmed associates they engage with

  • Capture the frequency of engagement with key person to understand pattern of life between individuals

  • Identify last known activity and with who


Note: all techniques detailed in this post are for educational purposes only and should not be used for illegal activity. OSINT Combine takes no responsibility for your use of this information.


If you have any other tips & tricks to share relating to this topic please drop us a line below.

0 views

©2020 by OSINT Combine