Flight Tracking

With so much news about Elon Musk’s private jet being tracked, this post addresses how to track planes with osint.

One can look for the plane registration as a starting point. The registration is written on the side of the plane. And is usually visible in photos of a plane.

Aviation news sites:

There are actually a lot of news websites devoted to aviation and are full of article about specific aircraft.

For example here is an article titled “Royal Air Force’s newest aircraft fleet reaches full-service capability” from UK-based Royal Air Force News ( https://www.raf.mod.uk/).

The article includes this photo that clearly shows the registration G-ZABH.

A google search of the registration will find a lot, be here we will focus on specific websites and what they offer.

Plane Spotting Sites

https://www.jetphotos.com/ – includes user uploaded photos of planes and all other forms of aircraft. A search here identifies the plane with additional data. At the top we see a photo uploaded to the site and several other photos below.

Click on the photo (not the text to the right of the photo) and you see this information about the photo from the user that uploaded it. most importantly, notice the date and location. Using this photos and the others, you can track where the aircraft has been observed over time.

Note that other plane spotting website can have additional photos, which is why you want to also google the registration to find other sites with photos of the same aircraft.

https://www.planespotters.net/ is another great resource that will often have additional photos of the same aircraft.

This site presents Airframe Info which gives a history of the aircraft from production to different operators over time as well as the different registration numbers assigned to the plane when it was used by each operator.

To find this, under a given photo find and click where its says “Airframe Info”

And you get the data presented as in the screenshots below.

ADS-B networks

ADS-B websites like Flight Radar 24 (https://www.flightradar24.com/) use ADS-B data to track aircraft. Once again there are different websites with different ADS-B networks and unique data. Therefore it is helpful to google the registration to find those other sites. But using Flight Radar 24, we get the following information that includes the current location of the aircraft and it’s movements over the previous 7 days. (Notice direct links to photos of the plane from jetphotos.com)

The site only gives you 7 days of history (try other sites to see if more data is available at that time). You can get more flight history by paying a fee.

If you want to keep tracking the aircraft and build your own history for it, you can use Visual Ping (visual ping.io). This site is used for tracking changes on a webpage. So you can input the specific webpage from Flight Radar for your aircraft and request updates daily or once a week.

See below where I have input the webpage url at Visual Ping and set it to look for updates in the page’s flight history section .

See the following advanced setting to make set up how it scrapes the photo (clicking a pop up button that would otherwise obscure the screenshot.

I prefer to get updates once a week and paste a screenshot in an ongoing word doc.

Twitter

In addition to google, twitter is a great place to search the registration number and you will get all sorts of data, especially updates over time.

For a more expansive flight tracking guide, I highly recommend this one from GIJN (like finding the owner)

https://gijn.org/flight-tracking/#jets

That’s it!

Hunch.ly Basics

This post gives a brief overview of how to get the OSINT tool Hunch.Ly up and running.

After downloading and installing Hunchly, here are the first basic steps to getting started so that it maintains a record of your Internet research.

First, click on the extension

Then when this window opens click on Dashboard

Create a new case, when the dashboard pops up click on the top left settings symbol and then click on New Case

Give it a name and click save

go back to the browser, click on the extension and then choose the case from the case drop down menu. Then turn on Capture.

go back to the dashboard and click on Tags, Add, and then name a tag for pages you want to keep track of that have a certain topic, such as “social media”. Then whenever you browse to a webpage you want to categorize as social media, click on the extension button in your browser, look up Tags, and click on Social Media

Then, we conduct some brief browsing and Internet searches for an example case. After this, open the dashboard again and we see the following.

Under our case KZ we see that 24 pages have been viewed and 5 basic google searches were conducted. Under the History section, there is a downloaded copy of each webpage we viewed so that we have a record of each without needing to return to the actual webpage.

Now we have officially used Hunchly to build and maintain a record of our OSINT research.

Additional Feature: Data Section

Hunchly parses the captured webpages for any reference of Onion URLs (both versions 2 and 3). If there are any, those will be listed in the Data section. Those onion URLs may or may not be active.

Clicking on the “Apply as filter” on the Hunchly dashboard’s Data tab will list the pages where those onion URLs were found. Please refer to the screenshot below:

Email and Social Media

Email and social media accounts are also parsed and presented in the Data section under the subsection Accounts. The Accounts includes email addresses and social media accounts. This often included email addresses you did not see when viewing a given page, possibly pulled from the webpage’s coding. The screenshot above shows accounts that were pulled. If you drill down to the individual accounts, you can click on one and the Hunchly dashboard will filter your history of webpages to show you only the ones that included the account in question.

That’s it!

Osint for NFTs – Part 1: how to lookup the who, where, and when

This post will avoid the deeper questions of what is an NFT. So for now we’ll use the gross oversimplification of describing an NFT as a picture with a unique ID that people buy and sell with cryptocurrency. (For a better backgrounder – click here)

Two important websites for this post are:

Opensea.io

Etherscan.io

Let’s get started.

For the sake of this example, let’s start with the NFT’s Token ID (a long string that is the NFT’s unique identifier). Here is a Token ID:

9961498451080298818169728249433222030914980129654055269747476883220178403329

Start at opensea.io (OpenSea is a marketplace for NFTs, other marketplaces include SuperRare, and Rarible)

We can search the ID directly in the search bar to find the NFT.

Click on the NFT and go to its profile page.

From the profile page you can look up a lot of information. Notable details include the current owner, the NFT’s history (creation, who sold it to who,etc), and it’s smart contract (which is basically an automatic contract, more below).

In the screenshot above you see it says “Owned by 160602”. This is the owner and you can click on the their ID number to go to a page with info on them. At the least you’ll see their activity but there might be other identifying information too.

Back to the NFT profile, the section “Item Activity” gives the history including creation and sales.

Under the “Details” section you find the contract address for the NFT’s smart contract .

The smart contract ID will be linked to the second useful website, etherscan.io

Click on the contract link and you’ll be brought here:

Reading a smart contract is a bit complicated and a topic for an upcoming post. But to learn more on the topic, see the article linked below.

What is a smart contract and how to read it? See this backgrounder here

Public Data in Criminal Justice Records

Photo from my trip to the county courthouse

The primary resources are:

  • Police records of incidents
  • Court case documents
  • Inmate locators
  • Court case audio recordings

People Search Websites:

PSWs were discussed previously, they are a great first step when researching someone as they will identify where the persons lives now and past addresses. After you obtain this information look up the counties for each address and then you can search if the person was involved in court cases of any kind.

County Court Systems:

While there are many courts with jurisdiction over a given location in some form, you should start with the county level courts. Any cases involving your person of interest are most likely located at the county level. If you have limited time, you can reasonably search only the county courts.

Each county court system will have a database where you should be able to search your person by name. The county circuit and district courts will entail cases ranging from criminal and civil cases as well as traffic violations.

The easiest way to find the relevant database is to google the county name and the phrase “court records”. Alters you can go to the county government website which will have a section for the courts. There will be a subsection for “case information” that tells you how to search court records. Many states have a single database that includes all of the counties’ court records.

In those states you can still begin at the county government websites which will inform you about the state-wide database.

When you find the database you should make sure you search the circuit and district courts.

Police records;

If you find that your person was involved in a criminal case, you can lookup police records to see details of the events that led up to the charges. Once again the easiest way to find the police records is to google the county name, the word “police records”, and one of the following phrases “dispatch incidents”, “daily arrests”, “summary of arrests”.

Most police records are not publicly available. However , the local police generally publish some form of daily summary of incidents and archive them in a list or database on their website.

Unfortunately this information is usually retained in a manner requiring you to search for incidents based on the date, vice a specific person’s name. If you find court records for a criminal case, the records should include the date and general location so that you have the information necessary to find the police record.

For example in Loudoun County, Virginia, the daily reports are posted here in the Sheriff section of the county website – (https://www.loudoun.gov/Archive.aspx?AMID=43)

Broadcasts:

If you are willing to pay $15, you can use the website Broadcastify (broadcastify.com/listen/) to find the police radio broadcast related to the incident. This can be helpful but you should not assume it will provide relevant information. The website archives audio files of radio broadcasts for police and emergency services categorized by time, date, location, and service (police, firefighters, etc).

Inmate search:

If the incident resulted in the person being incarcerated you can look them up by name in various inmate databases. The results will have the inmate’s name, serial number, and date of past or scheduled release.

If they are in federal prison you can look them up at – (https://www.bop.gov/mobile/find_inmate/byname.jsp).

State’s also have their own version, such as Virginia which has – (https://vadoc.virginia.gov/general-public/offender-locator/)

Bankruptcies:

All bankruptcy cases are heard in federal courts which can be accessed with PACER (see below)

Additional websites:

BKdata (https://bkdata.com/research/) is a private database that holds information on bankruptcy cases. It will charge a fee for full access but the free search is a great place to start if you want to find out if your person or company ever filed for bankruptcy

Court Listener (courtlistener.com) will search court case information across several hundred jurisdictions throughout the United States. Results include opinions, oral arguments, financial disclosures, and RECAP case files.

PACER (https://pcl.uscourts.gov/pcl/) charged a small fee but is the official database for all federal cases. You should always check the RECAP records (which are free versions of PACER records) in courtlistener.com before using PACER.

Obtain Audio Recording of a Court Case

If you are doing in-depth research on a court case you have the option to get an audio recording of the court proceedings. This requires paying a fee and a bit of legwork.

To do so, first use the state or county case information database and do a name search for the defendant as described previously. This will bring you to the court case information

In this case the court is the Loudoun county circuit court.

The records are handled by the Clerk of the court which will have a website or section in the county court system’s website.

In this case the website is here:

https://www.loudoun.gov/98/Clerk-of-the-Circuit-Court

And then click on the section specifically for requesting audio files which has instructions on how to submit your request, see below;

The instructions provide a form that needs printing, filling, and physically submitting. 

To fill out the form, we use the case records search for the court (as described previously) located in this database – https://eapps.courts.state.va.us/ocis/search

Here we can search for the defendant info to find the case and the record will give the information required by the form to identify the case and relevant information to input into the form for your request.

Here is an example of a case record;

Next, we take the form and check ($55 for two days of audio recording) and then head to the court!

Photo from my trip to the Loudoun county circuit court to drop off my request

That’s all for now.

Professional License Data

A surprising number of jobs require some form of state certification or license, which can provide good information about that person. This can determine if the person actually has their claimed profession, some personal details, and very often it will show any issues the person has run into. So in some cases a person had been suspended and the reason will be identified. But even a worker in good standing will have some relevant details in their license.

If you are researching anyone where you know their profession, it is worth a quick Google search asking if that profession requires a license in that state, or in general.

The website Career One Stop has a great tool (https://www.careeronestop.org/toolkit/training/find-licenses.aspx) that lists out all of the jobs requiring licenses and allows you to search by job title and state to see what kind of licensing requirements exist and where the public can look up an individual’s license.

Here is an example of using Career One Stop for searching a random profession. See the search function on bottom left of the screenshot below. The word “switch” is input in the keyword search and the chosen location is all locations.

The result from this search show various licenses available in different states and identifies the local government agency responsible for overseeing the licenses.

Clicking on one of the license names shows the following information about the job, the licensing requirements, and a website for the agency responsible for the process.

Clicking on the agency’s website brings us to the page below and it turns out there is an option for the public to look up licenses.

A search for a random last name brings up the following results. The database includes various different professions so even though we were originally looking at electrologists, the results show doctors.

Clicking on one of the names brings the following results.

That’s it.

Someone’s Past Political Donations

There are several great tools for looking up an individual’s political donations. Aside from the insight one can gain by learning someone’s history of political donations, the records will also provide information about the donor such as where they work.

National Politics

The Federal Election Commission’s official database has a tool for looking up a person’s contribution to federal candidates. (https://www.fec.gov/introduction-campaign-finance/how-to-research-public-records/individual-contributions/)

The FEC website also has a judicial section that gives access to FEC records on court cases, violations, audits, and similar issues.

See FEC walkthrough at the bottom of the article.

Open Secrets also has an individual donor lookup tool (https://www.opensecrets.org/donor-lookup) with FEC and some additional sources of data.

DS Giving (dsgiving.com) is a paid service but has a free option for looking up a person’s charity and political donations. The tool compiles the information in one place and includes some additional details.

State Politics

Each state maintains its own database for donations to state-level politicians. Generally it is easy to find these databases by googling the name of the state along with one of the following: “campaign finance database”, “board of elections”, “campaign finance”, or “political donations database”. In addition, each state has a database where lobbyists register and report expenditures. The website Follow The Money (https://www.followthemoney.org/) can assist as it compiles information about state elections, lobbyists, districts, and political contributions for the entire country.

Donor Lookup Example

Here is an example of looking up state-level contributions. Assuming we are researching someone that lives in Maryland…

Googling “Maryland” and “campaign finance database” results in the relevant database appearing at the top of the results.

Which leads to this website

We run a generic search under “contributor” for the name smith, and the result shows records on past donations, including the details of the donation itself as well as the donor / contributor’s name and address.

FEC example

If we go to (fec.gov/data) we have the option to research campaign finance data (which includes records on donations) on the bottom left or judicial records on the bottom right. We are focusing on donations / campaign finance but it is good to be aware that the judicial data is available.

Choosing to “search all campaign finance data” leads to the screen below where we have the option to search for a person by name on the bottom right.

By searching a random last name we get the results below that show individual donations. Each record shows the recipient of the donation, amount donated money, the date of the donation as well as the donor’s name, employer, and state where they live.

In the screenshot above there’s a triangle to the right of each record. If we click on one of the triangles a box pops up on the right side as you see below. The box provides some more in depth information about the donor, the donation, and the recipient.

Finally, in the image above there’s a grey box at the top that says “open image”. Click on it and it brings you to the form where the data was derived, as you see below.

That’s it!

Are You Searching for a Dead Person?

There are specific osint sources and information that is only available for people that have passed away.

Furthermore, standard sources for finding information on someone will often come up empty because your target is actually deceased. This is especially true with US-focused People-Searching Websites which often remove data on persons after their deaths. This post will explain how to check if a US-based person has passed away and/or find information that is only available about the deceased.

There are three main tools for finding dead people, and they are categorized by when the person died.

The time periods and associated tools are as follows:

1 – Deaths AFTER 2013 – Find A Grave (findagrave.com)

2 – Deaths between 1965 and 2013 – Ancestry-related websites that

3 – Deaths BEFORE 1965

1 – For Deaths AFTER 2013, researchers can use Find A Grave (findagrave.com). This tool focuses on finding actual graves (hence the name) rather than death records and relies on verified data from users. Despite the fact that this tool uses information from users, it is an amazingly comprehensive source, maybe even the best. There are MANY enthusiasts that search for graves and upload their information and often photos to source. And if the information you are looking for is not available, you can even submit a general request for someone to look for the grave of interest. Anecdotal evidence suggests that it is actually much more difficult to find graves that are NOT documented by this tool.

Finally, Find A Grave is useful for deaths that occurred at any date before or after 2013. However, I recommend this tool specifically for deaths after 2013 because most other tools do not have information during that time period.

2 – For Deaths between 1965 and 2013, the Social Security Death Index is the best source for Americans. Rather than accessing the indiex yourself, you will need to find a genealogy tool with access to the index. However, per information provided by Anceestry.com, the Social Security Administration stopped using the Death Index starting in 2014 and instead began documenting deaths in the Death Master File. Access to this later source is very restricted, and for all intents and purposes it should not be considered as a viable source in your osint research.

3 – For Deaths before 1965, any standard genealogy website will do the trick. Try using the genealogy sites FamilySearch.org, GenealogyBank.com, and Ancestry.com. FamilySearch.org is highly recommended and all of its information is free, you only need to register an account.

Returning to the issue of pre-1965 deaths, there is no specific database for this information. However, historic deaths is one of, if not the, most prioritized info sought after by genealogy websites so you can assume it is more likely than not that you’ll find the death record you are looking for. Most genealogy sites will automatically search all of their data sources, but if you are looking for a death record make sure your search includes Census data. The specific details of US census data becomes public record after 72 years and will be incorporated into any genealogy site you use.

The following includes a basic overview of using the relevant sites.

The Find A Grave Website

Nonetheless, the search function within the actual findagrave.com website is pretty thorough and gives a lot of different options for different ways to search for a record. Therefore, you may decide to try using the website itself.

For example, as you see in the findagrave.com search function below, you can even choose to search by burial plot information. That might seem like an obscure bit of information, but many records will identify the specific plot or cemetery section. Based on that information, you can search for relatives by looking for grave sites next to the first one, or for grave sites within the same section of the cemetery, possibly filtered for people with the same last name.

Below you see an example of the kinds of information that might be available in a particular record.

Your record may not always have identified family members, memorials, or photos, but you can generally count on four pieces of information being available:

1 – Name

2 – Date of Birth (and maybe location)

3 – Date of Death (and maybe location)

4 – The cemetery where they were buried

Social Security Death Index

The Social Security Death Index (SSDI) is an official list of American’s whose deaths were reported to the Social Security Administration. The SSDI is available online (though only included deaths after 1965) and can be accessed for free at FamilySearch.org, GenealogyBank.com, and Ancestry.com.

See the URLs below:

(screenshot from Genealogy Bank – https://www.genealogybank.com/explore/ssdi/all)

More information on the SSDI is available here:

https://www.familysearch.org/wiki/en/United_States_Social_Security_Administration_Records

Genealogy Websites

As noted before, there are several genealogy websites that can be used but we are going to focus on how to use just one for searching deaths, Family Search (FamilySearch.org).

After you go to the website and quickly sign up for a free account (there are no strings attached as far as I can tell), you then go to the main page. To reach the basic search function, click on “Search” from the menu bar and then click on “Records” from the drop down menu.

Later on, you can return to this drop down menu and click on “Genealogies” or “Research Wiki.” Clicking on “Genealogies” will let you search family trees that were uploaded by users. “Research Wiki” is a wiki of different local genealogy-related databases that are specific to different locations.

You’ll want to start with the search records functions. The following search window will appear. If you submit a search here, the website will also search for results that are similar but not exactly what you typed (such as names there are spelt similarly to what you typed). If this give you too many results, then before getting started, it might be worth clicking on “More Options,” so you can choose to search for an exact spelling of a name. 

The following window will appear and you will notice that there are options for search for exactly what you typed.

At this point look under the heading “Life Event” and you will want to click on “ +death ”. If you have additional info like location or date/year you can add that in on the line below but it isn’t necessary. W

hen you are done, just hit search and hopefully you’ll find the right info.

That’s all, good luck!

Private Investigator Basics: Skip Tracing and Property Liens

What is skip-tracing?

Skip-tracing is one of the central functions of private investigation.

“Skip tracing is a process used to find a debtor who has relocated or disappeared to avoid legal responsibilities, such as debt payments. The skip-tracing process involves verifying a debtor’s information, searching public records and contacting people who know the debtor.” …according to an article at wolterskluwer.com.

Given that skip-tracing is a broad topic, this post will focus on one part of the process- doing a lien search.

What is a lien ?

“A ‘lien’ is a notice that attaches to your property, telling the world that a creditor claims you owe it some money. A lien is typically a public record” …according to a post at Nolo.

Liens are a common way for creditors to collect what they’re owed. When someone puts a lien on your property, that property effectively becomes collateral for the debt.

There are 4 kinds of liens to look for

  1. UCC lien search
  2. Federal tax lien search
  3. State tax lien search
  4. County tax lien – Judgment lien search

A tax lien differs from a UCC lien because a recorded UCC financing statement shows a borrower agreed to give a lender an interest in a particular property in exchange for a loan; it’s a consensual lien. Tax liens, whether federal or state, are non-consensual. The borrower didn’t agree to the government taking a security interest in their property.

In some cases, the debtor isn’t even aware there’s a tax lien against them

How to Search?

Finding a recorded UCC-1 financing statement is relatively straightforward: you query the Secretary of State (SOS) where the property is located, or where the borrower is incorporated.

The IRS files the Notice of Federal Tax Lien with the secretary of state, county clerk, or state recorder’s office to secure your tax debt.

Liens against property can be recorded at the Department of Land Records alongside deeds. Search for liens online using state (some examples here will be Maryland focused because that’s my background- Maryland Land Records)(mdlandrec.net).

Some liens come from court judgments. If this happens, the lien may not be at Land Records. Go to state case searches (Maryland Case Search to search for court judgments against the property’s owner.)

Unpaid taxes on the property may result in a lien. Visit your local county or city’s finance office to find property tax or other municipal liens.

Walter Skluwer also adds the following advice:

Federal / ITS tax lien search – You can conduct a federal tax lien search at the following places:

  • State Recorder’s office
  • Secretary of State’s office
  • IRS Automated Lien System database
  • Private third-party database search services like Lien Solutions

State and county liens – Information on a tax lien is either maintained by the Secretary of State or the county tax office. Where the government records its interest depends on state law. Some states require recording certain interests at the state level. For example, Colorado files tax liens with its Department of Revenue’s Division of Taxation. Many others require agencies to secure liens in the county records office where the person, business, or property is located.

Several states have formed a tax lien registry which serves as a centralized location for recording and searching for tax liens. These states file all tax liens with the registry instead of at the county level, giving you one place to look instead of searching for information in several county offices

This is not very specific as the lien database varies depending on location, but with some patience this can be a useful way to gain info on a person of interest.

Internet Archives

This image has an empty alt attribute; its file name is image-27.png

Update: 1/1/2023

The Archives:

There are three main archives for US-related purposes, (though there are several other initiatives around the world, see wiki page List of Archiving Initiatives.).

web.archive.org – The Internet Archive / WAYBACKMACHINE is :

  • the archive with more archived data
  • does have keyword search
  • does have a reverse image search via – rootabout.com
  • BUT when you are searching for a url you will only find results for that exact url you typed

archive.is – Archive Today is :

  • a better archive for finding websites and information as it will find subdomains or related hosts for the url that you searched
  • can lookup social media and google maps
  • consider using spoonbill in conjunction with archive.is searches on Twitter, spoonbill technique (below) will let you see all a Twitter account’s profile changes over time
  • BUT it no keyword search tool
  • reportedly has less data than the Internet Archive

https://webarchive.loc.gov/ – The Library of Congress Web Archive is categorized and its content was deliberately chosen, therefore I think it is best to search for you subject matter before looking for a specific website. Alternatively, if you see your website-of-interest is archived there, look at its category so you can maybe find other useful sites. :

  • LOC is best used if you are looking for a specific subject. Go to the central page – https://www.loc.gov/web-archives/ – will let you search by subject, dates, locations, series, etc.

https://carbondate.cs.odu.edu/ – attempts to figure out when a website was created (consider using this in conjunction with whois history searches from previous post)

http://timetravel.mementoweb.org/ – look up archived website from specified date and time

Rootabout.com – does reverse image searches in Internet Archive and Open Library

Spoonbill – See Twitter profiles’ changes over time by using the following url with the account username:

https://spoonbill%5B.%5Dio/twitter/data/search_ish <–input other twitter usernames here and remove the brackets from ” spoonbill[.]io ”

Genealogy – Social Security Death Index

The Social Security Death Index (SSDI) is an official list of American’s whose deaths were reported to the Social Security Administration. The SSDI is available online (though only included deaths from 1965 to 2013) and can be accessed for free at FamilySearch.org, GenealogyBank.com, and Ancestry.com. See the URLs below:

(screenshot from Genealogy Bank – https://www.genealogybank.com/explore/ssdi/all)

The SSDI is a public database maintained by the Social Security Administration of US citizens who had received social security benefits (so not everyone but still most people in the US) and died after 1965 (when the list was computerized). This is a more or less comprehensive list of Americans who have died.

Genealogy websites often include this data in their repositories.

More information on the list is available here:

https://www.familysearch.org/wiki/en/United_States_Social_Security_Administration_Records

Freedom of Information Act Requests

You can submit a Freedom of Information Act (FOIA) request to the Social Security Administration to request the information listed in the deceased person’s original application form for a social security card, which is called an SS-5. You will have to pay a fee of about $20. You can request a copy of the original document, if it is available, or a computer generated list of the information from the form (this is called a “Numident printout”).

This service was surprisingly fast, I submitted my request for a Numident printout and received a response in the mail 16 days later.

For more information you can go to (https://www.ssa.gov/foia/request.html)

Process for FOIA request:

1 – Go to FOIA Online (https://foiaonline.gov/foiaonline/action/public/home) click on “create request” and then “begin”.

2 – in the next page, there is a drop down menu at the top where you choose which agency you are interested in. After you choose Social Security Administration a form appears for your SS-5/Numident request.

3 – Now you have to fill out the form, choose SS-5 or Numident, pay the fee, and hit “submit”

I requested a Numident printout and received my response in the mail 2 weeks later. Below is a redacted copy of what I received in the mail:

In particular, note the following pieces of information included in this response:

  • Date of Birth
  • Date of Death
  • Place of Birth
  • Place of Death
  • Social Security Number
  • Names of Parents

That’s it!