← back

keyword alerting

catch mentions of your name, phone, email, or address on the open web before someone else does

privacy monitoring osint

why alerting matters

tl;dr

identity monitoring services check breach dumps. keyword alerts check the public web. these are different problems and you need both. a broker removal service won’t tell you that a random blog just posted your phone number in a comment thread — but a Google Alert on that number will, usually within a day of it being indexed.

the open web is where doxing lives — forum posts, pastes, dumped chat logs, low-effort blogs, and content farms that scrape leaks and republish them for ad revenue. these sites don’t show up in breach databases because there was no “breach” — someone just typed your info into a comment box. an alert on the exact strings a doxer would use to identify you catches these within hours of them being indexed by google.

google alerts setup

tl;dr — setup steps
  1. go to google.com/alerts (signed into the google account you want notifications on)
  2. type your search query in the box — use quotes for exact-match strings
  3. set frequency to “as-it-happens” for high-signal terms, “at most once a day” for broad ones
  4. sources: “automatic” is fine for most; switch to “news + blogs + web” if you want to exclude youtube/discussions
  5. language / region: leave both as “any” unless you specifically only care about english results
  6. how many: “only the best results” hides most spam; “all results” is noisier but catches more
  7. deliver to: your email or an rss feed url

google alerts is free, has been running since 2003, and is still the best single tool for personal keyword monitoring on the indexed web. it re-runs your search query on a schedule and emails you when a new indexed page matches. the tradeoff vs paid tools is coverage — alerts only sees what google’s crawler sees, so private forums, telegram, and most short-lived paste sites won’t trigger.

advanced search operators

the reason keyword alerts are useful is because you can use google’s query language to make them precise. these all work inside a google alert query the same way they do in a regular search.

operatorexamplewhat it does
"...""555-123-4567"exact match — forces the whole string to appear as-is
OR"john smith" OR "j smith"either variant matches
-"john smith" -actorexcludes results containing the term
site:"john smith" site:pastebin.comonly matches on the given domain
-site:"john smith" -site:linkedin.comexcludes a domain (useful for filtering out your own profile)
intext:intext:"555-123-4567"the term must appear in body text, not just the url or title
inurl:"john smith" inurl:contactthe url must contain the term (finds public contact pages)
filetype:"555-123-4567" filetype:pdfonly matches within a specific file type — useful for leaked docs
*"john * smith"wildcard between words — catches middle names, honorifics

combine them. "john smith" "555-123-4567" -site:linkedin.com -site:whitepages.com will only fire on pages that have both strings together and aren’t your own linkedin or the top broker sites you already know about.

what to actually watch for

tl;dr — suggested alerts
  • "Firstname Lastname" — obvious but noisy; use exclusions to prune
  • "Firstname Middlename Lastname" — much quieter, catches formal listings
  • "555-123-4567" OR "5551234567" OR "(555) 123-4567" — phone number in all common formats
  • "you@example.com" — your primary email; add each variant you actually use
  • "123 Main St" "Yourtown" — address plus city forces both to appear together, cuts false hits
  • "handle" site:pastebin.com OR site:ghostbin.com OR site:justpaste.it — your handles on paste sites specifically
  • "handle" "password" — catches credential dumps that mention your username
  • your kid’s full name, if you have one — harder to remediate than yours
gotcha alerts that trigger on your own name will fire on your own social profiles, articles you’ve written, obituaries of unrelated people, and any celebrity who shares your name. spend the first two weeks tuning exclusions with -site: until the signal-to-noise is manageable, otherwise you’ll turn them off.

limits