OSINT investigations on Spotify
During OSINT investigations, we sometimes have to think outside of the box. Not every subject has an account on major social media platforms such as Facebook, LinkedIn and Instagram. In those cases, it can be useful to consider other, less obvious platforms. A platform like Spotify, for example. After all, criminals, fraudsters and terrorists also listen to music. In this blog, we explain how you can involve Spotify in OSINT investigations. We explain what data you can find on Spotify and how to search for it.
About Spotify
According to Statista.com, the music streaming service Spotify had about 144 million users worldwide with a paid license in the third quarter of 2020. If we can believe headlines like “Almost three million paying users” and “Half of the Netherlands uses Spotify“, Spotify is also extremely popular in the Netherlands. Spotify can therefore be interesting to involve in an OSINT investigation. After all, there is a chance that our subjects will be active on this platform. Time for a deeper look into Spotify.
What can we do with Spotify?
This blog aims to describe what data can be found on Spotify and how to search for this data. We specifically focus on profiles of users on Spotify. That means we focus less on songs, artists, albums, playlists, podcasts and episodes. After all, during your OSINT investigation you will probably benefit most from searching for and investigating user profiles.
Searching for users on Spotify
How can you search for user profiles on Spotify? Very simple: just use the search bar of Spotify itself (both accessible via the web version and via the mobile application). If you log in to Spotify with your (fake) account, you can use the search bar to search for songs, artists, albums, playlists, podcasts, episodes and profiles. After you have logged in, click on “Search” on the left-hand side and then use the search bar at the top of your screen.
Searching for display names
In the search bar above (the web version of Spotify) you can search based on a user’s name. A user’s name is referred to as a “Display name” on Spotify. According to Spotify, a display name refers to the following: “A display name replaces the username where it shows on your profile, app, playlists, and Friend Activity.“ When you have typed in a name, scroll down until you reach “Profiles“. If necessary, click on “View all” on the right side to view more profiles.
As you can see in the image above, based on the search term “Eric” several profiles are shown that contain all or part of the name “Eric“. So you can also search Spotify for parts of a user’s name. In addition, please note that you may encounter different accounts with the same “Display name“ on Spotify. As you can see in green below, there are multiple users with the name “Eric Owens“, however these are different user accounts. For example, if you look at the area marked in red, you will see that the first profile refers to a user with the username/ID “121124366” while the other accounts refer to other usernames and/or identification numbers.
If you search for people with the name “Eric” through the Spotify search bar, your URL query will look like this: https://open.spotify.com/search/eric. With this search you will again see songs, artists, albums, playlists, podcasts, episodes and profiles. Note: are you not logged in to Spotify? With the same search query as above you will only see search results of songs, artists, albums, playlists, podcast and episodes. If you are not logged in, you will not see any search results for profiles on Spotify.
Can you search without being logged in to Spotify? Certainly, but not via Spotify itself. A search engine offers you a better solution in this case. Via Google, for example, you can search specifically based on the search term in the image below. After all, from the image above, you know that profiles on Spotify have a link that looks like this: https://open.spotify.com/user/{username}. By searching specifically for this section, in conjunction with your subject name, you can map different profiles of users on Spotify. Keep in mind that you depend on whether a search engine like Google has indexed the account you are looking for.
Search for usernames
Above we have described how you can search based on a “Display name” of a user. You can also search Spotify for a user’s username. A username on Spotify is called a “Username” and according to Spotify means the following: “Your username is designed to identify you on Spotify, so it can’t change. But you don’t need to remember it to log in, just use your email address and password, or Facebook.”. A username is therefore unique and unchangeable, which makes a username an interesting piece of information.
What does a username on Spotify look like? For some users, a username is a series of automatically generated numbers/figures (https://open.spotify.com/user/121124366), for other users this username is a name set by the user (https://open.spotify.com/user/owens-eric). This makes it useful to search for users based on their username as well. On Spotify itself you can do this by typing the following in the search bar: spotify:user:owens-eric which is equivalent to https://open.spotify.com/search/spotify%3Auser%3Aowens-eric which (after URL decoding) equals https://open.spotify.com/search/spotify:user:owens-eric.
The result that you will then see is again the profile of the user with the link https://open.spotify.com/user/owens-eric. This means that you can also search directly from the URL https://open.spotify.com/user/{username} to search Spotify for users with a specific username.
Note: are you not logged in to Spotify? Then unfortunately you cannot use the search functions spotify:user:owens-eric and https://open.spotify.com/search/spotify:user:owens-eric, but you can use the search function https://open.spotify.com/user/owens-eric. In other words, if you are not logged into Spotify, you can directly type the username in the URL to search for users based on their username.
Searching with an email address
Above we have focused on searching for users based on a “display name” and a “username“. We now explain how to check if an email address is in use on Spotify. To do this, go to Spotify and click on “Sign up” or navigate directly to https://www.spotify.com/nl/signup/. Fill in your subject’s email address below “What is your email address?“ and hit the Enter button. Do you see the message “This email address is already linked to an account”? You now know that there is a user on Spotify who uses this email address.
Note: with the abovementioned technique you can only find out that a user is linked to an e-mail address. You do not yet know which user is linked to the e-mail address in question. Further investigations on Spotify therefore is important. Would you like to implement the above in a more automated way? Then you can also use the Spotify API: https://spclient.wg.spotify.com/signup/public/v1/account?validate=1&email=ericowens@gmail.com where you can import email addresses using your own written scripts.
Investigating user profiles on Spotify
In the previous section, we explained how to search for users on Spotify by name and username. We have also explained how you can check whether an e-mail address is in use on Spotify. In this section, we explain which data you find on a user’s profile that may be relevant to your investigation. We make a distinction between the following data:
- Display name
- Username
- Profile picture
- Followers
- Following
- Playlists
- Recently played artists
Display name of a user
The name of a user concerns the “Display name” and we have already discussed in the previous section. A user’s name is different from a user’s username. Do you have a username? Then a search based on a username on Spotify can lead to a name of the user itself. In the image below, the user’s name is “Eric Varnado“. Note: it is possible to log in to Spotify via Facebook. Often the username of the Facebook profile is taken over when logging in. So it may be worthwhile to search Facebook for users with the same name as the name on the Spotify profile.
Username of a user
The username of a user concerns the “Username” and we have already discussed this username in the previous section. A user’s name is different from a user’s username. Do you have a username in your investigation? Then a search based on a username on Spotify can lead to a name of the user itself. In the image below, the user’s username is “wandererpublishing“.
Profile picture of a user
The profile picture of a user on Spotify is an interesting piece of information. In some cases, a profile photo is the same photo as used by a user on Facebook. This may be the case if the user is logged in to Spotify via Facebook. As with the “display name“, it may be the case that a user’s profile picture has been taken from Facebook, which may mean that you come across the same profile picture on Facebook. You can read more about the link with Facebook furtheron in this article.
Would you like to view the image in a larger format? Then open your browser developer tools (F12), click on “Network” (1), select “Images” (2), refresh the page and read the location of the image (3 and 4). Open this image location to view a larger size (if available) and to save the image.
Note: In some cases, user profile photos will not be loaded when viewed through the web version of Spotify. In that case, it may make sense to use the Spotify mobile application. The mobile application will show you profile pictures.
Followers of a user
A user’s “followers” are the users on Spotify who follow your subject’s account. These followers are interesting because these followers may have a relationship with your subject. The followers can be people who like the music taste of your subject, but they also can be, for example, family members or friends. The list of followers is certainly worth a closer look. You can view the followers by clicking on “Followers“. Note: it does not matter whether you are logged in or not. Followers of a user are public.
Following of a user
The heading “following” indicates which users on Spotify are being followed by your subject. These profiles are interesting because these profiles, like your subject’s followers, may have a relationship with your subject. You can view the list of followed profiles by clicking on “Followers“. Also here it doesn’t matter whether you are logged in or not, the followed accounts are always public.
Please note that for both the following and the followed accounts you will see an overview showing both “artists” (marked in green) and “profiles” (marked in red). Of course, the profiles are interesting because these are profiles of users on Spotify.
Would you like to view the followers and the followed accounts in a JSON format (thanks Dutch_Osintguy for this tip)? Then open the browser developer tools by clicking F12. Select the option “Network” and search for the requests that contain “followers” and “following“.
Run the cURL command from your commandline and view the result in JSON format. You will receive data as shown below. This list of information is of course easier to use if you want to deal with larger amounts of data. Keep the name “DJ Atia” (see below) in mind for a while, because we’ll use it again further down this article.
Playlists of a user
A user’s playlists are playlists created by the user itself or created by other users which playlists are followed by your subject. In both cases, the playlists may be relevant to your investigaion. For example, based on the content of the playlist, you can determine what kind of music or artist your target likes, which you can then use to investigate further. And you can also see who created the followed playlists and which users follow these playlists. After all, this can give you the indications of relationships of your subject. Note: users on Spotify can protect their playlists through their privacy settings.
Recently played artists by a user
Just like a user’s playlists, the list of recently played artists can also say something about your subject. According to Spotify, this list of recently played artists is always public.
Connection with Facebook
In the section above, we already described that users can log in to Spotify with a Facebook account. Spotify has written an article about this which can be viewed here: https://support.spotify.com/us/article/facebook-login-help/. For you as a investigator, it may be interesting to consider whether you can possibly end up with a Facebook user from a Spotify user, and vice versa. As mentioned earlier, the “display name” and the profile picture of a Facebook user may have been used on Spotify when creating an account on Spotify.
For example, if we take one of the users from the JSON output as an example, the “image_url” will lead to a larger picture of the profile (https://scontent-atl3-2.xx.fbcdn.net/v/t1.0-1/p320x320/75543502_2474119619500466_7094739073331363840_o.jpg?_nc_cat=107&ccb=1-3&_nc_sid=0c64ff&_nc_ohc=KRYooP2xBVcAX_bzoHf&_nc_ht=scontent-atl3-2.xx&tp=6&oh=09f88ade3d572f5116b1af7ed26944e7&oe=606C1118).
If we then search Facebook for a user named “DJ Atia” (see the image above), this results in the profile https://www.facebook.com/profile.php?id=100007073565917. The first thing you’ll notice is that this user’s profile picture matches the user’s profile picture on Spotify.
When we compare the two URLs, it leads to the URLs below that partially overlap. So could this be a user who used the Facebook profile to log in to Spotify? That is possible, but further investigation is of course necessary to draw this conclusion.
More information?
In this blog post, we have explained how you can search Spotify for data and how this data can be useful for your investigations. Do you have questions about or additions to this article? Please let us know! Would you like to know more about conduction Open Source Intelligence nvestigations? Then view our OSINT training courses.