Using Hunchly’s Selectors for Google Analytics Tracking Codes

You might remember a pretty awesome post by Lawrence Alexander on Bellingcat where he detailed how to make connections between websites using Google Analytics tracking codes. These are the little snippets of HTML or Javascript that you won’t see with your eyes but are lurking underneath millions of websites. The tracking codes allow a website owner to see who is coming to their site, and how they are behaving while on the site.

How it is useful for an investigator lies in the fact that website owners will typically re-use the same code across multiple websites. This can be extremely handy, for instance, when a website owner uses anonymous information in their domain information. You can still link sites together, or potentially even de-anonymize them if they have one domain with the WHOIS information available but many others with domain privacy (anonymous) turned on. Linking these sites together with Google Analytics tracking codes is really useful at times like those.

The Problem

Lawrence does a fantastic job of laying the groundwork on how to search multiple services (including Google) to find common tracking codes. This technique does work (we further automated the process here) to find connections. However, one downside is that Google, Meanpath and other services that you can use to search for tracking codes are only as good as their database. This means if they haven’t crawled and stored the tracking codes before you started your research, you may be missing other sites that include the tracking codes.

The other issue is that in order to check every single site you are visiting for that tracking code, you need to view the HTML source for each page and then do a search within that page to try to find the tracking code. This is not going to be a great use of your time but it is definitely thorough.

The Solution

Hunchly has what is called: Selectors. Selectors are keywords, names, email addresses or any piece of information that you would like to be alerted to if it is discovered on a web page that you are viewing. As each page is stored in the Hunchly database it is examined for selectors that pertain to the current case that you are working on.

New Google Analytics Tracking Code added to Hunchly as a selector.

If Hunchly discovers that a selector is present on the page, it notifies you in the Chrome Browser Bar to let you know that you have a hit. This includes any of the HTML source code or text that is buried in the page. This is extremely useful as you are progressing through an investigation as there is a lot of information you don’t visually see on the page (i.e. Google tracking codes) but are important from an investigative standpoint. I don’t know anyone that views the source code of every single page they read, and thankfully there is no need to do that any longer.

Hunchly notifying you that a selector was found on the page you are viewing.

An additional feature of Hunchly selectors is that if you discover additional information as you are moving through a case, and you enter a new selector, Hunchly scans all of the pages from that case that you have already stored. If it finds any previous hits it will let you know.

For Your Next Investigation

If you are hunting around websites, do a View Source on some of the target sites, and look for tracking codes like Lawrence demonstrates. Grab those codes and drop them into Hunchly as a selector. You might be surprised how often you find information that connects two or more websites together.