> [!info] > Input: [[Social Media Posts|posts]], comments and replies, [[Social Media Activity|actions]] > Output: [[Geolocation|timezones (historical and current)]], region > > Types: [[Behavioural Weakness|behavioural]], [[Technical Weakness|technical]] > Weakness: [[SOWEL-5. Exposing the Fact of Activity]] > Functionality: [[SOFL-1. Communications]] ### Explanation Every public action on a platform — a post, a comment, a like, a profile edit, a story view, a "last seen" timestamp — carries a timestamp. Aggregated across days and weeks those timestamps reveal the target's underlying daily schedule: when they wake up, when they're at work, when they sleep, which days of the week are quietest. That schedule collapses to a probable timezone, and the timezone collapses to a probable region. Plot the timestamps as a heatmap (hour-of-day on one axis, day-of-week on the other) and look for the consistent silent block — that's the target's sleep window. The midpoint of the block, anchored to a known time zone, identifies the target's UTC offset to within an hour or two. Compare against the timezone the profile claims publicly; a discrepancy is a strong signal of either relocation, a VPN, a sockpuppet, or a coordinated operator running the account from a different region. The technique is especially powerful against accounts trying to hide location: bio says "London" but activity peaks at 11pm GMT and goes silent at 4am GMT, which is 3am–8am Moscow time — fits Moscow much better than London. Combine with [[SOTL-5.5. Study Activity at the Same Time]] for sockpuppet correlation and with [[SOTL-5.10. Study Posts Metadata]] for cross-reference against device hints. ### Examples {{some links to articles, videos, etc}} ### Tools {{some links to tools}} ### See also - {{internal links to similar techniques}}