The research process nobody teaches you about networking.

Networking is often framed as "luck" or "personality." In reality, it's literacy. Knowing how to find the path separates people guessing from people getting replies.

What I'm about to share falls under OSINT—Open Source Intelligence. Information collected from publicly available sources. No hacking. No private databases. No illegal shortcuts.

Here's the toolkit:

1. Master Google-Fu (Advanced Search Operators)

Standard searching is for tourists. Use operators to strip away the noise:

site:instagram.com "Target Name" — bypasses platform algorithms to find their real social presence
filetype:pdf "Target Name" — finds speaker bios, published research, whitepapers they've authored
intext:"@gmail.com" "Target Name" — searches for their contact info across the web

2. Username Search

People are creatures of habit. If their LinkedIn is /jdoe_92, they likely use that handle elsewhere.

WhatsMyName.app or Namechk.com show you every platform where that username exists—Reddit, GitHub, Medium, personal blogs.

This tells you what they actually care about beyond their resume. Do they contribute to open source? Write on Substack? That context makes your outreach relevant instead of generic.

3. BuiltWith

Shows you a company's entire tech stack. If they just migrated to a new CRM or changed hosting infrastructure, your outreach becomes a relevant conversation instead of cold solicitation.

4. Reverse Image Search (With Boundaries)

Google Images reverse search finds where else a photo appears online.

FaceCheck.ID uses facial recognition for deeper searches.

Use this to: Verify someone is who they claim (not a fake profile with stolen photos) or connect professional accounts when you only have a photo.

Don't use this to: Find personal accounts they intentionally kept separate. If someone has a private Instagram under a different name, respect that boundary.

5. Hunter.io

Drop in a company domain, get verified email patterns and active addresses. No more guessing at "[email protected]."

The Guardrails

Simple test: Would you feel comfortable telling the person exactly how you found their information?

If yes → legitimate research

If no → you've crossed into creepy territory

Research should inform your outreach, not replace genuine connection. The goal is showing up informed enough to have a conversation worth their time.

Do the homework. Be thoughtful. Don't be weird.

Stay Dangerous.

0 comments