How I Removed a Client’s Old (and Embarrassing) Accounts with a Couple of Tools

"I don't remember a single thing!"

That's what my client told me (note: he's a barber in Rome whose shop I pop into every once in a while). And no, he wasn't having a sudden bout of amnesia with a pair of scissors in his hands, thankfully.

He was simply explaining that he had no idea how to access a bunch of accounts created a lifetime ago. Since he was quite young back then, privacy wasn't exactly top of mind for him.

After telling him I could help, I first had to put his mind at ease. Digging deep means I'm going to stumble across your go-to passwords, a few embarrassing accounts, or some questionable followed profiles. Personally, I couldn't care less, but transparency upfront is key.

Professionalism first: bro, I'm not here to judge whatever trashy sites you signed up for; I'm just here to help you purge them where possible.

Getting Down to Business

We started with the biggest headache: a couple of pre-2018 Instagram accounts cringe enough to warrant immediate deletion - and those two IG profiles are exactly what we'll be focusing on in this article.

We had to wipe those profiles. Period.

And then came the classic refrain: "I don't remember anything." No email access, no access to that old phone number anymore.

Since video selfies, account deletion emails to support, and all those bureaucratic hoops rarely work (come on Instagram, get your act together!), I stepped in to break the deadlock. I asked him for any handles or nicknames he might have used back then. To top it off, he couldn't even remember which damn email address he'd used to sign up.

So, we kicked off the investigation using a list of known nicknames he recalled alongside his old IG handles. To pull this off, I used Osintly, which is a solid tool for initial enumeration:

Account #1: Single-Digit Permutations and Password Patterns

Through Osintly, we managed to identify the first email address. As mentioned, we had zero access to the old phone number, as he'd changed it years ago after a bad breakup.

So, we moved to breach data correlation. We queried the email against breach records and found a hit containing a legacy password base. But trying the raw leaked password directly got us nowhere.

That's where human pattern indexing comes in. When asked how he used to tweak his credentials back then, he recalled always appending a single-digit number to his base string (spoiler: his absolute favorite number turns out to be "1").

Now, while this specific client happened to remember his favorite digit, you don't need to play password-therapist with every target. Standard OSINT methodology relies on running targeted mask attacks and rule-based dictionary generators based on common user behavior patterns.

We applied the single-digit variation rule to the leaked base string, and boom! We were in.

Incredibly, the account was still sitting there untouched. Between the obscure local email provider (hardly a primary target for automated account squatters) and that simple single-digit modification, no botnet had managed to hijack it. We recovered the email, reset the IG password, and made account number one (the newer of the two) vanish into thin air. Poof.

Account #2: Methodical Pivoting over Guesswork

That left us with the second account, but this time we hit a brick wall. Searching for the email address he swore he used yielded absolute zero across every database.

This is where methodology replaces guesswork. Unless a client has complete amnesia, people rarely invent entirely new digital identities out of thin air, as they tend to reuse structural patterns.

I asked him to break down the root of his old handle. It turned out he was searching for something like nameone, completely forgetting that his teenage self had inserted a random digit inside the string, making it name1one. No wonder direct email queries were coming up empty.

Since the exact email string was uncertain, we flipped the approach and pivoted to a reverse password pattern search:

1. He recalled that platforms eventually started forcing special character requirements during password updates (and since his beloved "1" didn't qualify as a special character, his lazy workaround was to slap an exclamation mark (!) at the end and capitalize the first letter).
2. We generated the corresponding MD5 hashes for those specific pattern variations.
3. We queried raw breach datasets directly for matching unsalted hashes.

The structured approach paid off. One of our generated MD5 hashes hit a clean match inside a leaked motorcycle forum dump, and sitting right next to it was the actual email address (name1one@...).

He gasped: "Aaaaah, that's it! I completely forgot about that digit!"

We attempted to log into his old Hotmail account using the permuted password variation, and the auth succeeded. We regained access - and since it was a legacy Microsoft account, it contained a goldmine of forgotten data - allowing us to execute the final password reset and permanently wipe the second IG profile.

The Takeaway

OSINT isn't magic, and breach data isn't a silver bullet, especially if the target has total memory loss. But when standard recovery options fail (and let's be real, Meta hates seeing accounts deleted), relying on structured methodology - combining nickname enumeration, password pattern hashing, and reverse pivoting - is one of the few reliable technical paths that gets the job done.