How to Locate Aggressors and Nefarious People Online

How do you find out who anonymously posts information about you, your company, or your country online? We set up a fake company, imaginary CEO, social media, and fictitious backers to trap anonymous perpetrators posing as our clients’ Ministry of Finance. This is how we did it.

Our client, a country, had a problem with someone claiming to be a representative of their Ministry of Finance. This impersonator was offering financial incentives for startups willing to relocate — for a “small administrative fee” paid in advance. The scam damaged the country’s online reputation, so we sprang into action.

We led the perpetrators to believe we were interested parties located in a foreign country, helped locate the thieves, and turned the information over to our client. The problem was then resolved. We like to think black stealth helicopters were involved at some point.

How We Found the Bad Guys

The perpetrators used a Microsoft Outlook email address, so we had a starting point. Outlook and similar webmail services route through shared servers that are rarely near the sender’s actual location.

The key to identifying anonymous users is the IP address — the unique numerical identifier that shows where someone is accessing the internet from. An IP address can often pinpoint a user to the city level, and sometimes to within a few feet.

For example, the IP address shown on the map above identified my exact location outside a coffee shop in Sausalito, California, where I wrote this article.

Modern email platforms like Gmail and Outlook no longer include the sender’s true IP address in email headers. Gmail stripped sender IPs for all users in 2021, and Microsoft followed similar privacy practices. To capture a real IP address, you need the perpetrator to visit a website — ideally without knowing they’re doing it.

Identifying Anonymous Senders

Find Who Owns an Email Address Using Reverse Email Lookup

If you only have an email address, a reverse email lookup may reveal the sender’s identity. We sometimes use Spokeo’s reverse email identification tool, which searches online databases including social media profiles.

It’s worth noting that domain registration records — once a useful data source — have become far less informative since ICANN implemented GDPR-compliant WHOIS redaction policies in 2018, which now hide personal registrant data for most domains. In our case, the bad guys were using a one-time email address with no connections to other accounts, leaving us no additional clues at that stage.

How to Get an IP Address Even If the Email Is Unlisted

If a reverse lookup yields nothing, consider sending a tracked email using a service like ReadNotify. It can capture approximate geography, IP address, and other details when the recipient opens the message.

This is one of the methods we used — though its reliability has declined. Since Apple introduced Mail Privacy Protection (MPP) in 2021, many email clients pre-fetch message content, including tracking pixels, masking the recipient’s true IP. These tools are still worth deploying, but they are no longer as dependable for IP identification as they once were.

For a broader look at how anonymous attackers operate, see our guide on how to identify someone who is attacking you online.

Building the Honeytrap

Building a Juicy Target

We developed a false company name, a logo, and an imaginary CEO with a complete biography — including fictitious children. We also created the appearance of financial backers, complete with blog articles, bio pages, and more, to convince the perpetrators we were a real target.

We made the backstory convincing enough that authors wrote glowing stories about our fake company. Because the fake company was set in a foreign country, we translated everything into the local language. We even kept the social media profiles active using Hootsuite to bulk-schedule posts in advance, so the accounts appeared organically active without constant attention.

Inviting Bad People Over for Tea

If tracked emails don’t yield results, you may be able to get perpetrators to visit a honeytrap website that reveals their IP address. One approach is to add a comment to a negative post online, including a link to an “apology” or other lure that leads to your honeytrap page.

If the platform allows direct messaging, contact the offending poster that way. If they provided an email address, use it. The goal is to get that specific person — and ideally only that person — to visit a controlled page where you can log their IP.

Building an Electronic Mousetrap

To trap our thieves, we set up a website for the fake company in yet another foreign country, along with accounts on X (formerly Twitter), Facebook, and LinkedIn. A cursory look by the bad guys revealed a CEO, a technology startup, and apparent financial backers — all in both English and the local language.

You can build your own honeytrap site using a hosting service like GoDaddy with a WordPress installation, or through platforms like HostGator, Squarespace, or Wix. Each offers a quick path to a convincing-looking site without deep technical expertise.

Anyone who visits the blog will arrive from an IP address — and unless they are hiding it with a VPN, you may be able to determine their general location. That caveat matters: VPN usage has grown dramatically, with an estimated 31–35% of internet users globally using one regularly as of 2024, according to GWI. IP-based identification is a useful signal, but it is not foolproof.

Track IP addresses with a tool like StatCounter, which logs the IP of each visitor. Note that Google Analytics 4 anonymizes IP addresses by default, so it won’t surface individual visitor IPs. For honeytrap purposes, a dedicated visitor-logging tool like StatCounter is the more practical choice.

Making Your Honeytrap Site Invisible

Making the Entire Site Invisible

NoIndex tags prevent search engines from displaying a site in results, but there are nuances worth understanding. A noindex tag stops a page from appearing in search results, but it does not prevent crawlers from visiting — for that, you also need a robots.txt disallow rule.

Be aware that if Google is blocked from crawling a page via robots.txt, it may not be able to read the noindex tag at all. Using both in combination is the safest approach. Also ensure your WordPress site does not automatically add new pages to its XML sitemap, which would signal their existence to search engines.

Making a Single Page Invisible

Alternatively, make only a single hidden page invisible and place the StatCounter code there. Build that page with plain HTML rather than WordPress to ensure it isn’t linked to anything else. This gives you a standalone page — your “apology” or other lure — that exists in a vacuum and is visited only by your target.

How We Filtered Out the Wrong Users

In our Ministry of Finance case, we made the site look real while invisibly turning search engine robots away. That narrowed visitors down to a handful we had lured through online comments and email responses.

The website alone wasn’t what identified the perpetrators — that came from the email tracking described above. The site served to verify us as convincing targets. But the IP addresses logged on the site matched those from the tracked emails, giving us two independent data points to confirm the identity.

This kind of reputational attack — where bad actors impersonate a legitimate organization — is one of the more damaging scenarios covered in our ultimate guide to crisis management and reputation repair. You may also want to review our overview of reputational risk management to build defenses before an incident occurs.

In the End, We Found Them

We identified the perpetrators’ email address, IP address, location, language, mailing information, and more. We turned everything over to the government that hired us, and the problem was resolved.

This project was an example of international online reputation management at its most creative — combining content strategy, web development, SEO, email tracking, social media, foreign language translation, and some luck. All working together to make the world a better place.

If you’re dealing with a damaged reputation as a result of impersonation or online attacks, our guide on how to rebuild your reputation after a crisis offers practical next steps. For ongoing protection, see our overview of how to protect your online reputation.

Read This: Changing Google’s Knowledge Graph