Post cover image
© Alexander Kaufmann — Unsplash.com

July 24, 2026

I Tracked Myself Using AI — What I Found Kept Me Up All Night

It took 40 minutes and zero dollars to find my home address, daily routine, even my license plate. Here’s what I did next.

By Hartarto

10 min read

Estimated read time: 12 minutes · Tags: Cybersecurity · OSINT · Digital Investigations · Privacy · Tech

I want to tell you about the night I stopped sleeping well.

It started as a dare to myself. I'd spent years writing about cybersecurity, warning other people about digital exposure, OSINT, data leaks — all the usual stuff. But I'd never actually turned the lens on myself. So one evening, with a coffee going cold next to my laptop, I decided to do exactly what a stranger with bad intentions could do to me, using nothing but free AI tools and a single old profile picture.

Forty minutes later, I had my own home neighborhood narrowed down to three blocks. I had a rough daily schedule based on when I post online. I had a partial vehicle description pulled from a photo I'd forgotten I ever posted. I hadn't hacked anything. I hadn't paid for anything. I hadn't broken a single law. I had just used the same free, legal tools that are sitting in plain sight for anyone to use.

That's the part that kept me up. Not that it was possible — I already knew that in theory. It's that it was easy. Easier than ordering food delivery.

If you've never heard the term OSINT before, don't worry — by the end of this article you'll understand it better than most IT professionals do, and you'll know exactly how to check your own exposure, for free, tonight.

What Is OSINT, Really? (Explained Like You're Five, Not Like a Textbook)

OSINT stands for Open Source Intelligence — which sounds like spy-movie jargon, but it just means: information that's publicly available, and what you can learn by connecting the dots.

Think of it like this. Imagine every photo you've ever posted, every review you've left, every forum comment, every "check-in," every LinkedIn update — imagine all of that sitting in separate little boxes scattered across the internet. Individually, each box seems harmless. A photo of your coffee. A comment on a hiking forum. A five-star review of a dentist near your house.

OSINT is the skill — now supercharged by AI — of taking all those separate boxes and lining them up next to each other until a full picture appears. Governments use it. Journalists use it. Recruiters use it before your job interview. Private investigators build entire careers on it. And yes — so do scammers, stalkers, and criminals.

The uncomfortable truth is: you don't need to be hacked to be exposed. You just need to exist online.

I know, I know — you're probably thinking "okay but that sounds exaggerated." Trust me, I thought the same thing. Then I actually tried it. Here's exactly what I used, and where you can get the same tools for free.

The Free AI & OSINT Tools That Can Find Almost Anyone

Here's the toolkit, broken down so a total beginner can understand what each one actually does — not just its name.

1. Reverse Image Search (Google Images, TinEye, Bing Visual Search)

What it does: You upload a photo, and it finds every other place that exact image — or very similar ones — appears online.

Why it matters: That "harmless" profile picture on a dating app? If you've used it anywhere else — Facebook, a company bio page, a old blog — reverse image search connects those identities together in seconds.

Tools you can use right now (all free):

None None None

Quick honest tip from me to you: don't just try one of these and stop. I thought Google Images had "found everything" about my old photo — then TinEye pulled up a listing I'd completely forgotten existed. Run the same photo through all three.

2. AI Facial Recognition Search Engines

What it does: Unlike basic reverse image search, these tools use AI trained specifically on faces. They can match a photo of a person even if the photo is cropped, filtered, taken from a different angle, or years apart in age.

Why it matters: This is the technology that turns "a photo of a stranger" into "a name, a hometown, and a dozen social profiles." It's legal to use in many jurisdictions for personal lookups, which is exactly why it's so unsettling.

Tools you can use:

None None

I'll be straight with you here — this is the one that genuinely unsettled me the most. Go ahead, search yourself. Just… maybe don't do it right before bed like I did.

3. Metadata & EXIF Data Extractors

What it does: Every photo taken on a smartphone carries hidden data — the exact GPS coordinates where it was taken, the device model, the date and time, sometimes even the direction the camera was facing.

Why it matters: Most people never strip this data before posting. A single un-scrubbed photo can hand over your exact home address without you saying a word.

Tools you can use:

None None None

Go on, be honest — when's the last time you actually checked what's hiding inside a photo before posting it? Yeah. Me neither, until this happened.

4. People-Search & Data Aggregator Sites

What it does: These sites scrape public records — property records, court filings, voter registrations, old social media — and package them into a single profile: your name, age, relatives, past addresses, phone numbers.

Why it matters: Most of this is legal to collect and sell in many countries, which is exactly why it's terrifying. Your data doesn't need to be "leaked" — it's simply for sale.

Tools you can use:

None None None None

Here's a question worth sitting with for a second: how would you feel if I told you your relatives' names were probably already on one of these, right now, for anyone with five dollars? Because mine were.

5. Social Media Username Correlation Tools

What it does: These tools take one username and check hundreds of platforms simultaneously to see where else that exact username has been used.

Why it matters: People reuse the same clever username everywhere — the gaming account, the anonymous forum account, the "real" account. This tool erases the wall between them instantly.

Tools you can use:

None None None

Quick confession: I still had a username from a forum I joined back in 2013 that I thought was long dead. It wasn't. Sherlock found it in about ten seconds.

6. Geolocation-from-Photo AI

What it does: Even without GPS metadata, AI models can now analyze the background of a photo — a street sign, a plant species, the angle of shadows, architecture style — and estimate where in the world it was taken.

Why it matters: This is genuinely one of the most jaw-dropping capabilities in modern OSINT. A photo you thought was "clean" of location data can still be geolocated by pattern recognition alone.

Tools you can use:

None None

This is the one that made me put my phone down and just stare at the wall for a minute. No GPS data. No caption. Just a background blur — and it still guessed the right city.

7. Public Records & Business Registry Search

What it does: Searches government-published records — property ownership, business registrations, professional licenses.

Why it matters: People forget these are public by design. A home address tied to an LLC registration is a common accidental leak.

Tools you can use:

None None

Fair warning, this one's less dramatic than the others — but if you've ever registered a small business or a side hustle using your home address (I did), it's worth ten minutes of your time.

8. Breach & Leak Databases (like Have I Been Pwned)

What it does: Lets you check whether your email address or phone number has appeared in a known data breach.

Why it matters: This is the single fastest way to know if your passwords or personal info are already floating around on hacker forums.

Tools you can use:

None None

And yes — this is the tool I mentioned earlier. If you skipped the gut-check below, go back up and actually try it. I promise the rest of the article will still be here.

Quick Gut-Check: Try This Right Now

Before you keep reading — open a new tab, go to a breach-checking site, and type in your primary email address. I'll wait.

Did anything come up? If it did, you're not alone — billions of records have been exposed in breaches over the past decade. But now you know, and knowing is the entire game in cybersecurity. If this made your stomach drop a little, keep reading — the second half of this article is exactly how to fix it.

From "Aware" to "Master": How Security Professionals Actually Use These Tools

Here's the part almost nobody explains properly: these exact same tools are the bread and butter of professional penetration testers, security researchers, and corporate red teams. Companies pay real salaries — and bug bounty hunters get paid real bounties — for exactly this skill set, used defensively and ethically.

If you want to go from "curious beginner" to someone who can genuinely assess IT security — your own, or eventually as a career — here's the structured path.

Step 1: Master the Mindset Before the Tools

Every real practitioner starts with a simple question: "If I were trying to compromise this target, where would I start?" Applied to yourself, that means: What's publicly visible about me right now, today, without anyone hacking anything?

Step 2: Build Your Own OSINT Baseline

Before you can protect anything, you need to know what's already exposed.

  • Search your own full name in quotation marks

  • Reverse image search your 3 most-used profile photos

  • Run your email through a breach checker

  • Search your own phone number

  • Check what a people-search aggregator already has on file about you

Write it all down. This is your "attack surface" — the real, unglamorous term security professionals use for everything an attacker could exploit.

(Yes, actually write it down. I skipped this step the first time and had to redo the whole exercise a week later because I couldn't remember what I'd already found. Don't be like me.)

Step 3: Learn to Strip Metadata Like a Professional

Every photo you're about to post — pause. Before uploading, run it through a metadata stripping tool (many free ones exist, and most modern phones now let you disable location tagging in camera settings). Make this a habit, not a one-time fix.

Step 4: Practice Cross-Referencing (The Real Skill)

The actual professional skill isn't using any single tool — it's connecting what multiple tools tell you. A username from one platform, a face from another, a location clue from a third. Practice building a "profile" of a public figure (ethically, using only public information) to train your pattern-recognition instincts. This is precisely the exercise used in entry-level cybersecurity and OSINT training programs.

Step 5: Go Deeper With Structured Training

Once the basics feel natural, this is where hobbyists become genuinely employable security professionals. Structured courses, capture-the-flag style labs, and certification paths exist specifically to formalize this skill (see the reference list below).

Step 6: Turn Defense Into Offense (Ethically)

The endgame for many people who fall down this rabbit hole isn't paranoia — it's a career. Bug bounty platforms pay real money for people who can find security holes before criminals do. It's the same skill set, applied with permission, for a paycheck instead of a headache.

Don't Just Read This — Do It

Here's my challenge to you: pick one tool from the list above, and actually use it on yourself before you close this tab. Not tomorrow. Now. Most people read articles like this, feel a brief chill, and change nothing. The 5% who actually run the check are the ones who fix what needs fixing before someone else finds it first.

If this article opened your eyes even a little, follow me here on Medium — I'm writing this entire series in real time: OSINT, AI-driven cybersecurity, and the uncomfortable truths of digital privacy in 2026. The next piece goes even deeper into professional-grade tools.

Final Thought

I didn't write this to scare you into deleting all your social media and moving off-grid. I wrote it because there's a massive gap between what people think is private and what's actually, technically, publicly connectable with a bit of AI-assisted effort. Once you see it, you can't unsee it — but you also finally have the power to close the gaps that matter most.

Knowledge in cybersecurity isn't about paranoia. It's about no longer being the easiest target in the room.

10 Free Resources to Learn Cybersecurity & OSINT Properly

  1. https://tryhackme.com

  2. https://www.hackthebox.com

  3. https://owasp.org

  4. https://haveibeenpwned.com

  5. https://www.sans.org/cyberaces

  6. https://www.hackerone.com

  7. https://www.bugcrowd.com

  8. https://www.coursera.org/browse/information-technology/cybersecurity

  9. https://www.cisa.gov/resources-tools

  10. https://osintframework.com

Disclaimer: This article is for educational purposes only. Always use OSINT and security tools ethically, legally, and only on yourself or with explicit authorization. Unauthorized surveillance or data collection on other individuals may violate privacy laws in your jurisdiction.

Tags: #OSINT #Cybersecurity #DigitalInvestigation #OpenSourceIntelligence #Privacy #InfoSec #Hacking #Beginner #FreeSecurity #DigitalPrivacy #ThreatIntelligence