It doesn't have to be that technical. People search for references that connect your username with a real name and possibly a location. If there is only one per

It doesn't have to be that technical. People search for references that connect your username with a real name and possibly a location. If there is only one person with your name in your town, then your home address and likely phone number can be derived from there. No hacking skills required there, just researching. If you send the target a link and they click on it and you control the server, you can find the IP address use to click on it and aren't using a VPN. Home IP addresses don't change often, so with the IP address you have another bit of information that can searched on. This might lead to a second username associated with the IP address. Sometimes simply paying attention to the content they post reveals a lot. Once on a Reddit someone posted a "Guess what state this photo is from" post. It could have been from many places, but I checked out his profile and all of his posts from the same place in Pennsylvania, so I guessed that. He seemed amazed that anyone guessed so fast, but also unaware how the other content he posted made it very easy to fill in the blank. Also, many people aren't trying that hard to hide, because they don't expect that anyone to put any effort into "outting" them.