[smokenn]

Hello,

I need a help and a guidance on finding out the true owner of a website.

Website is using Wordpress 4.9.8 (latest version)
Whois doesn't give any interesting information: registrar is namescheap.com, it is protected by cloudflare, hosting provider is: NFORCE, NL.
There aren't any sub-domains (except: www).

I have tried tools such as:
Whois domain analyzer, Nslookup, Nmap, TheHarvester, Metagoofil, DNSRecon, Sublist3r, Wafw00f, WAFNinja, XSS Scanner, WhatWeb, Spaghetti, WPscan, WPscanner, WPSeku, Droopescan, SSLScan, SSLyze, A2SV, Dirsearch
...however I either don't know what to look for, or the information is protected behind namescheap and cloudflare.

None of the wordpress plugins have any known vulnerabilities, he's having all his plugins updated to the latest versions.
Plugins used: contact-form-7, woocomerce, really-simple-ssl, sucuri-scanner, yith-woocomerce-compare, cmb2, wp-slimstat.
Theme used: greenmart by Thembay, v1.6.0.
It does have xmlrpc.php, not renamed, and he does have: wp-config-sample.php not renamed.

he does have these folders exposed to the public:
../wp-includes/
../wp-content/uploads/
../wp-content/plugins/
but I can't find anything useful in there (of course I can't access PHP files to get their content).


My option #1 would be to find who this guy is, because taking down his website may just result in him finding another hosting company and host his website on another place.
Option #2 would be to take down his website (however, ddos-ing on a cloudflare protected website doesn't seem to work for very long). So I guess option #3 would be to find out real IP behind the cloudflare.

Any advice, guidance is more than welcome. I'm not asking you guys to do stuff for me, but to give me directions, I want to learn this stuff on my own.

[mothered]

I need a help and a guidance on finding out the true owner of a website

You're generating too much energy on the website, rather than other means of Information gathering.

If there's a contact form, use It to make an Inquiry and receive a response via email thereafter. Have a look for Identifiable Information In the email address Itself, the contents of the message received, Inspect the email header for timestamps, IP address etc, perform a reverse email lookup, view the email's recovery options for any cell phone numbers linked, check the email address against all major websites for further Info and the list goes on.

[Cr3aTor]

I need a help and a guidance on finding out the true owner of a website

You're generating too much energy on the website, rather than other means of Information gathering.

If there's a contact form, use It to make an Inquiry and receive a response via email thereafter. Have a look for Identifiable Information In the email address Itself, the contents of the message received, Inspect the email header for timestamps, IP address etc, perform a reverse email lookup, view the email's recovery options for any cell phone numbers linked, check the email address against all major websites for further Info and the list goes on.

^^^ Pretty much
Once you find his identity it's pretty much game over, you can see what is he interested in, family members, where he works, etc and then SE him.

[smokenn]

Thanks for the tip! I appreciate it!

But this guy is pretty clever.
He's using proton mail ..@pm.me (paid version) for email communication. And proton mail hides any information about the real person sending the email. Even changes the GMT zone, so timestamp extracted wouldn't be very helpful. All the IP addresses direct to protonmail.ch/protonmail.com servers.
Before PM.ME, he was using GMX mail, and before that: Gmail, and Gmail allowed me to attempt to login to his account, and see his recovery options, but that wasn't very helpful because all I could see were parts of his recovery email or cell-phone number. Same goes for paypal: he used those same GMX/Google to register for PayPal account, so again I could see parts of his recovery emails or cell-phone numbers.

I even attempted a basic phishing process, built a temp. website asking him if he plans on getting the product from that website (my website), so he'll have to visit the page in order to see what I'm talking about, however the IP I hooked after he visited it appears to be a VPN IP: 185.212.171.203 (when I visit this IP, I get info about it being NordVPN), so I know he's trying to be extra safe, which makes all of this even more difficult for a beginner like me.

He does own several social media profiles. But he's using fake names on each of his profile, and fake profile images (for example: CEO of one of the bus companies in Spain). And all he does on his social media profiles is advertising his website. Do you feel like finding who this guy is would be easier through social media profiles?

[Leehwaak]

I guess you could always go for the most used SE technique, if you know it is a guy for sure and you believe he is worth your time and trouble then you can engage on social media with him under a fake account. If not then you can just leak his data on a website that you can later send to him and get whatever you want from him