Using Hunchly’s Selectors for Google Analytics Tracking Codes
How it is useful for an investigator lies in the fact that website owners will typically re-use the same code across multiple websites. This can be extremely handy, for instance, when a website owner uses anonymous information in their domain information. You can still link sites together, or potentially even de-anonymize them if they have one domain with the WHOIS information available but many others with domain privacy (anonymous) turned on. Linking these sites together with Google Analytics tracking codes is really useful at times like those.
Lawrence does a fantastic job of laying the groundwork on how to search multiple services (including Google) to find common tracking codes. This technique does work (we further automated the process here) to find connections. However, one downside is that Google, Meanpath and other services that you can use to search for tracking codes are only as good as their database. This means if they haven’t crawled and stored the tracking codes before you started your research, you may be missing other sites that include the tracking codes.
The other issue is that in order to check every single site you are visiting for that tracking code, you need to view the HTML source for each page and then do a search within that page to try to find the tracking code. This is not going to be a great use of your time but it is definitely thorough.
Hunchly has what is called: Selectors. Selectors are keywords, names, email addresses or any piece of information that you would like to be alerted to if it is discovered on a web page that you are viewing. As each page is stored in the Hunchly database it is examined for selectors that pertain to the current case that you are working on.
If Hunchly discovers that a selector is present on the page, it notifies you in the Chrome Browser Bar to let you know that you have a hit. This includes any of the HTML source code or text that is buried in the page. This is extremely useful as you are progressing through an investigation as there is a lot of information you don’t visually see on the page (i.e. Google tracking codes) but are important from an investigative standpoint. I don’t know anyone that views the source code of every single page they read, and thankfully there is no need to do that any longer.
An additional feature of Hunchly selectors is that if you discover additional information as you are moving through a case, and you enter a new selector, Hunchly scans all of the pages from that case that you have already stored. If it finds any previous hits it will let you know.
For Your Next Investigation
If you are hunting around websites, do a View Source on some of the target sites, and look for tracking codes like Lawrence demonstrates. Grab those codes and drop them into Hunchly as a selector. You might be surprised how often you find information that connects two or more websites together.