Anonymous blogging and Google Analytics: how Ewhois’ reverse lookup can reveal your identity

If you’re blogging anonymously, it’s always safer not to have your own domain because you could be traced through your Google Analytics ID. Your anonymous blog or pseudonymous online business may share the same ID as your non-anonymous sites, so if someone your identity then all they have to do is heck the ID of your anonymous site and one of your non anonymous sites, and they’ll have a match. Some tools which let you check Google Analytics or AdSense IDs will even tell you which other sites share the same ID, so all anyone has to do is type your site’s or blog’s address in and they’ll see all the sites you have.

To avoid this, just create a new Google Analytics account for your anonymous blog, or register for a domain anonymously.

Some bloggers and many sites use Google Analytics to check stats. However hosted domains (blogging platforms to you and me) like WordPress, Blogspot or tumblr are safe. Some articles allege that they are safe because they do not use Google Analytics; but this isn’t true because if you use the Ghostery browser add-on, it tells you that WordPress does use Google Analytics. Although I seldom venture over to Blogspot, the couple of times a Twitter link has taken me there while I product-tested Ghostery, Ghostery told me that Google Analytics was being used there, too. So I don’t know why blogging sites are safe while other domains aren’t, but it’s not because they don’t use Google Analytics.

This is how easily you can be found – I put the name of a site into Ewhois, a free site which offers reverse lookup for Google Analytics and reverse IP lookup. (Which means it shows you everyone who is using Google Analytics, so if you use it you can be found). Ewhois checks both Google Analytics and AdSense IDs. For ethical reasons I chose someone who is not anonymous and will not be harmed by anyone knowing which other sites they have, and who has themselves outed an anonymous person for no reason:

It literally takes a second; I did it while typing this post

In just a few seconds Ewhois returned the results, which included all sites on the same IP address (which doesn’t necessarily mean they are owned by the same person, but are maybe just sharing an ISP) as well as a phone number, fax and approximate address, which I’ve redacted:

EWhois gives out lots of info about you in a second, and clicking the tabs below gives out even more.

Worst of all, it reveals the name you used to sign up for a domain. In this case, the person is not anonymous (or, rather, used the same pseudonym she is known by to sign up to her domain). Had she used her real name, I would now know it (though her real name is published on the internet anyway; she is no longer anonymous which is why I chose her for this experiment.) And once you know someone’s real name, it’s easy to Google their address and occupation, even photos. So, your name and approximate location – and therefore your address and photo- can be found pretty much instantly – bad news if you’ve got a nasty colleague who would tell your boss you’re bitching about how awful your work is. (Or whatever you’re doing.) And if you’re using anonymity to say something that the authorities don’t want you to, they could be driving out to you immediately after putting your site into Ewhois and Goohling your address. You wouldn’t know they were coming.

I also tested to see if “Stella”‘s blog as well as Slutocracy could be found by Ewhois, and both of them can’t be found:

This appears to prove that blogs on hosted domains like WordPress and Blogspot are safe. Obviously, don’t take my word for it because I only tried it out on two ‘anonymous’ bloggers – “Stella Marr” and myself – and neither of us are actually really anonymous; we’re pseudonymous. I know some real anonymous bloggers, but obviously I don’t want to know who they are. Knowing who someone is always carries a risk for that person even if you keep their identity a secret, because you can be tricked into revealing it or your computer can be hacked. And when people are anonymous, it’s more fun; they have this persona. Knowing their boring real names and jobs takes the fun out of it.

It may be safe to assume that blog platforms are much, much safer though – it still took time for journalists to find out who the bloggers Girl With a One Track Mind, Belle de Jour and NightJack are.

So, to recap:

Register for a domain anonymously or using a pseudonym

Don’t get your own domain, use a blog hosting platform

If you already have your own domain, create a new Google Analytics account for your anonymous sites

Or don’t use Google Analytics or Adsense

Protect your IP address (using the Tor browser) so Ewhois can’t show it even if it shows other stuff (though if Ewhois shows your name, there’s no point protecting your IP address).

 

If you want to check if you can be found, just go to EWhois here: http://www.ewhois.com/ .

Useful article on anonymous blogging and Google Analytics: http://www.wired.com/business/2011/11/goog-analytics-anony-bloggers/

How to blog anonymously by Brooke Magnanti (who blogged anonymously as Belle de Jour): http://sexonomics-uk.blogspot.co.uk/2012/05/how-to-blog-anonymously-and-how-not-to.html

My product testing and review of anonymous browsing and anonymous blogging downloads: https://slutocracy.wordpress.com/2013/01/30/review-of-anonymous-blogging-and-browsing-tools-product-testing-hotspot-shield-vpn-tor-and-ghostery/