Find a site the target visits frequently that lets you inject something that will make a request to your server (“poisoning the well”). Use the gathered IP address, User-Agent and Language headers to start building a persona to look for.