The Chinese Spy: Tracking a California Realtor from Real Estate Listings to the French Alps

Executive Summary

In passive open-source intelligence (OSINT), an investigation rarely follows a straight line. Verifying identity consistency across personal profiles, news media reports, and professional registries is crucial to avoid false positives.

This walkthrough documents the full investigation of Wanying “Heather” Zhang, a California real estate agent indicted on federal charges of acting as an unregistered agent of the Chinese government. Following the exact chain of discovery—from initial Google dorking to Facebook cross-referencing, moniker extraction, and final associate identification—we reconstruct each analytical step.

A special thank you to OSINT Industries for crafting engaging, realistic CTF challenges that continuously challenge and elevate passive reconnaissance methodology across the community.

Phase 1: Operational Framework & Starting Identifiers

The challenge provided baseline context and constraints:

• Subject: Wanying “Heather” Zhang
• Profession: Real Estate Agent (Realtor in California)
• Objective: Discover her personal real estate Facebook profile, extract her associated email address, correlate its local part to her secondary social media account, and identify an associate photographed alongside her at Tomorrowland Winter on March 24, 2025.
• Rules: Passive OSINT only; zero active interaction or authentication attempts.

Phase 2: Open-Source Dorking & Profiling the Target

To locate her presence on Facebook within California’s real estate ecosystem, an initial targeted Google dork was constructed:

site:facebook.com "Wanying Zhang" OR "Heather Zhang" "realtor" OR "real estate" California

The search query revealed mainstream press coverage (TaiwanPlus, ABC 6News, The Real Deal, FOX) detailing the arrest of 34-year-old Wanying “Heather” Zhang at LAX for conducting surveillance on Taiwanese officials. These reports offered crucial biometric anchors: reference headshots, age, geographic ties to Irvine/Los Angeles, and mentions of her background.

Phase 3: Facebook Profile Discovery & Contextual Pivot

Querying Facebook directly for accounts matching the subject’s criteria yielded candidates matching her professional profile in Southern California.

The primary matching profile listed:

• Current City: Los Angeles
• Education: University of Southern California (USC)
• Profession: Real estate broker

Cross-referencing this profile against news archives (which reported her USC education and her husband’s identity) confirmed we were analyzing the correct subject.

Phase 4: Moniker Harvesting & Secondary Account Correlation

The challenge brief noted that the local part (the prefix preceding the @ symbol) of her email address was identical to the handle used on another social media platform where she posted festival and travel memories.

Pivot searching this persona led directly to her active Instagram presence: heatherzhangwy

Phase 5: Brokerage Directory Lookup & Email Extraction

With the local part confirmed as heatherzhangwy, locating the complete registered business email required pivoting to commercial real estate registries in Orange County.

Searching licensed realtor databases for Zhang’s firm yielded her listing at JC Pacific Capital Inc in Irvine, CA.

Figure 5: Professional real estate directory entry confirming licensed sales records, office address, and contact email.

The public broker registry definitively confirmed her email:

• Brokerage: JC Pacific Capital Inc (2100 Main St Ste 102, Irvine, CA)
• Email Address: heatherzhangwy@gmail.com

Phase 6: Timeline & Media Cross-Referencing

To corroborate family connections and biographical data uncovered during the investigation, press references and auxiliary social records were reviewed.

Figure 6: Independent reporting corroborating the identity of Zhang and her husband/fellow broker.

Returning to the social timeline around March 24, 2025, the target had documented her European trip—including attendance at Tomorrowland Winter in the French Alps followed by a final shopping day in Paris. In the media captures from this operational window, Zhang appeared alongside a traveling companion.

Tracing mutual links, profile tags, and corresponding media led directly to the associate’s private profile: @cathyyy_lulu (Catherine).

Flag Resolution

With all puzzle components verified across open registries, media reports, and social feeds:

• Target Email: heatherzhangwy@gmail.com
• Associate Username: @cathyyy_lulu

$\mathbf{OSINT\{heatherzhangwy@gmail.com\_@cathyyy\_lulu\}}$

Key Takeaways

1. Avoid Early Discard Bias: Initial discrepancies in lighting, styling, or casual angles between booking mugshots and social media uploads can create false doubts. Cross-verifying institutional ties (e.g., USC education) anchors identity before visual confirmation.
2. Handle-to-Registry Synergy: When privacy settings restrict email visibility on Facebook, leveraging handle reuse (heatherzhangwy) alongside state real estate directories provides clean, authoritative attribution.