Flight Tracking

With so much news about Elon Musk’s private jet being tracked, this post addresses how to track planes with osint.

One can look for the plane registration as a starting point. The registration is written on the side of the plane. And is usually visible in photos of a plane.

Aviation news sites:

There are actually a lot of news websites devoted to aviation and are full of article about specific aircraft.

For example here is an article titled “Royal Air Force’s newest aircraft fleet reaches full-service capability” from UK-based Royal Air Force News ( https://www.raf.mod.uk/).

The article includes this photo that clearly shows the registration G-ZABH.

A google search of the registration will find a lot, be here we will focus on specific websites and what they offer.

Plane Spotting Sites

https://www.jetphotos.com/ – includes user uploaded photos of planes and all other forms of aircraft. A search here identifies the plane with additional data. At the top we see a photo uploaded to the site and several other photos below.

Click on the photo (not the text to the right of the photo) and you see this information about the photo from the user that uploaded it. most importantly, notice the date and location. Using this photos and the others, you can track where the aircraft has been observed over time.

Note that other plane spotting website can have additional photos, which is why you want to also google the registration to find other sites with photos of the same aircraft.

https://www.planespotters.net/ is another great resource that will often have additional photos of the same aircraft.

This site presents Airframe Info which gives a history of the aircraft from production to different operators over time as well as the different registration numbers assigned to the plane when it was used by each operator.

To find this, under a given photo find and click where its says “Airframe Info”

And you get the data presented as in the screenshots below.

ADS-B networks

ADS-B websites like Flight Radar 24 (https://www.flightradar24.com/) use ADS-B data to track aircraft. Once again there are different websites with different ADS-B networks and unique data. Therefore it is helpful to google the registration to find those other sites. But using Flight Radar 24, we get the following information that includes the current location of the aircraft and it’s movements over the previous 7 days. (Notice direct links to photos of the plane from jetphotos.com)

The site only gives you 7 days of history (try other sites to see if more data is available at that time). You can get more flight history by paying a fee.

If you want to keep tracking the aircraft and build your own history for it, you can use Visual Ping (visual ping.io). This site is used for tracking changes on a webpage. So you can input the specific webpage from Flight Radar for your aircraft and request updates daily or once a week.

See below where I have input the webpage url at Visual Ping and set it to look for updates in the page’s flight history section .

See the following advanced setting to make set up how it scrapes the photo (clicking a pop up button that would otherwise obscure the screenshot.

I prefer to get updates once a week and paste a screenshot in an ongoing word doc.


In addition to google, twitter is a great place to search the registration number and you will get all sorts of data, especially updates over time.

For a more expansive flight tracking guide, I highly recommend this one from GIJN (like finding the owner)


That’s it!

Researching a U.S. Company’s Government Ties (the basics)

Previous Contracts with the Government

If you need to find out whether a company has ever been contracted by the U.S. government, you can use USAspending.gov and search on the company name to get a quick answer. This is a user-friendly database that will tell you specifically which part of the U.S. government was involved (for example: “Political Section, US Embassy Tunis”). It will also provide the details about the contract and the company personnel involved.

Past involvement in government corruption

A good way to evaluate a company is to see if it has conducted any actions violating laws or regulations. The nonprofit Good Jobs First maintains a Violation Tracker, which is a single source that queries a plethora of U.S. government databases identifying companies that violated local or national regulations.

Political Donations

If the target makes any political donation of at least $200, it is listed in the Federal Election Commission database, but can be best searched by using the Donor Lookup tool at OpenSecrets.org. Depending on whether the donor is a person or a company/organization, this tool will identify the donor’s name, address, occupation, amount of money contributed, and the recipient. Here is an example of the results from searching on a fake last name:

Another great source of information on political donations is the Public Accountability Project, which searches several public deep web databases including property records. This site will also find records for smaller donations in the low two digit range. The website is free but requires that you register for an account.


If a person of interest is involved in any federal lobbying efforts, the lobbyist will be registered and the contracts with their clients can also be viewed with the same lookup tool at the aforementioned OpenSecrets website General Search function. These contracts and further information may also be available on the Foreign Agent Registration Act database depending on whether the party being represented is a foreign entity.

Revolving Door Between Corporate Lobbyists and Government Employment

OpenSecrets.org tracks when individuals develop conflicts of interest by cycling between jobs in the public and private sectors. Open Secrets maintains this information in a database called Revolving Door. Open Secrets the purpose of Revolving Door as follows:

While officials in the executive branch, Congress and senior congressional staffers spin in and out of the private and public sectors, so too does privilege, power, access and, of course, money.

Use the search options to discover which public relations firms have signed up former White House employees, which lobbyists have brought their interests with them to the powerful appropriations committees, which interests are employing former members of Congress to lobby on their behalf…and much more.

The advanced search will allow a researcher to search by a wide variety of criteria including but not limited to a person’s name, their current or former government employer, lobbyist firm, administration, and congressional committee. You can research any party involved in a government contract but you can also start by researching any company or government office of interest.

Researching a Company

There are several publicly accessible “deep web” databases with records on U.S. companies. The records are especially interesting because, by nature of being deep web databases, one cannot find these records in these databases by simply googling for them. Furthermore, the records are usually verified, legitimate information, which is of course not always true of things on the Internet.

Company Registration

US companies register with the state government and this registration is most easily discovered by using Open Corporates . The individual states maintain deep web databases that are full of company registrations. To avoid the trouble of finding all of the databases, you can use Open Corporates. This site allows one to search the name of a person or a company and then Open Corporates searches the various state registries at a once. Open Corporates also searches for other registrations, including trademarks.

Side Note for Foreign Companies: For foreign companies, many countries’ registries will be included in Open Corporates. But for countries that are not included in Open Corporates, you can use the Global Open Data Index to find out if the country has a public registry and if so, it will give you an idea where to look. The Index is dated to 2015, but it can tell you that the registry is located, for example, in the Interior Ministry website under the tax section.

Publicly Traded Companies (in the US or abroad)

Publicly traded companies must file additional records on a regular basis. This is topic too extensive for this post, but the basic information is that the US Securities and Exchange Commission maintains a public database called EDGAR (the Electronic Data Gathering, Analysis, and Retrieval system).

Side Note for Foreign Companies: There is a website where you can look up the Securities Commission for foreign counties. Go to the International Organization of Securities Commissions and look up their members (there are several different types of members (ordinary, associate, affiliate) to look up.

If one is interested in a publicly traded company/corporation, you can start by searching for its name in EDGAR and looking at the most recent document titled “Annual Review.”

This document includes several pages of information largely in financial-speak, but for the amateurs it includes names and senior company officials and recent company developments such as court cases.

Past Illegal Activity

A good way to evaluate a company is to see if it has conducted any actions violating laws or regulations. The Violations Tracker is a single source that queries a plethora of US government databases identifying companies that violated local or national regulations.

Other Useful Websites

Researching a U.S. Nonprofit

Registration Records

Nonprofit organizations register with the state government and this registration, similar to companies’ registrations, is most easily discovered by using Open Corporates. Alternatively one can find this information on the individual state government website. State databases for nonprofits are listed on Open Corporates’ list of registers.

In a nonprofit’s registration record, one can expect to find the names of directors/officers, a postal address, and the lawyer that was hired to register the nonprofit. Various other information may also be included in the record depending on the state where it was registered.

Tax Filings

The tax filings for most nonprofit organizations are publicly available at IRS.gov, but one is better off using Propublica’s Nonproft Explorer or Guidestar. The tax forms include the names of board members, key employees, their compensation, services rendered, and contractors used by the nonprofit.

This screenshot is an example of how Propublica’s Nonprofit Explorer displays tax information for one organization . This record is partially obscured for privacy.

This information is a summary of the tax record. To read all of the data (including the names of people involved in the nonprofit) one can click on the “990-T” button on the left.

See my other article for more in-depth research on non-profit tax filings and fraud.

How to Find U.S. Court Records

Court records in the U.S. are often public available but they are divided up into a myriad of public databases. It is easiest to focus on whether the court hearing the case is federal, state, or county (even though courts are further divided beyond those levels).

Terminology: A Case File refers to a file of every single legal document in the case, so basically everything. A Legal Opinion is a written explanation by the judge or judges that accompanies their ruling (just to be clear, the ruling is identified in this document).

The term Docket refers to different things depending on the jurisdiction, but it generally refers to a sort of schedule of court hearings. The Docket often refers to who is involved in the case, where and when it is happening and why. Much of this information is only recorded before the case occurs but in certain jurisdictions the Docket will entail the ruling and/or events of the case.

Federal Level

The best free resource for court records is Court Listener, a website for researching federal and state court opinions. The site is maintained by the nonprofit the Free Law Project, which exists largely for the stated purpose of enabling the public to access court records.

Judy Records is also a great resource for court records at any level.

PACER is another good resource that sort of straddles the divide between free and paid. PACER does require payment but generally at the end of the year they will dismiss the bill for anyone that spent less than about $15 that year. PACER is the official resource government resource for docket and case files of federal courts.

If you want to use PACER, you should definitely get the RECAP, a free browser extension that automatically searches for free copies of whatever record you are seeking in PACER. Specifically, it archives files from U.S. Federal District and Bankruptcy Courts. RECAP was created by Harvard and Princeton Universities and is maintained by the Free Law Project referenced above.

Dockets for federal cases are available for free here in a less than friendly format in the Federal Judicial Center’s Integrated Database. At the bottom of the screen you choose between Civil, Criminal, Bankruptcy, and Appeals and then choose “interactive mode” or download all of their data.

SIDENOTE: What are all of these kinds of courts and cases?

When you are looking for a specific person in court records you may, depending on the database, first have to choose which kind of case records to search before you can search for your person’s name.

Federal Courts – generally, you can expect a case to be in federal court if A.) it is a legal dispute between two people from two different states, B.) if it is a bankruptcy case, C.) a case of federal law, according to legal expert Marc Newman (https://millerlawpc.com/difference-state-federal-courts/).

State and County Courts – most importantly, you can expect criminal cases here (state and county laws are most likely to be the laws violated in general). But also family law cases, personal injury suits, contract disputes, and traffic violations, also according to Mr. Newman.

Circuit Court – the name is a bit deceptive, circuit courts are generally state and lower courts but they largely focus on civil and criminal cases. If you are looking for a civil or criminal case in a state or county database, you will likely need to choose to specify that you are looking in “circuit court” before you can choose “civil cases” or “criminal cases.”

Civil – is when two people or parties have a dispute. One party files a complain against the other and they go to court. The parties will settle in a private agreement or go to trial, where either a judge or jury (depending on the trial) will decide on a resolution for the two parties.

Criminal – is pretty straight forward. The government brings the case because it believes that someone has broken the law, we have seen various iterations on tv.

Bankruptcy – bankruptcy cases are only in federal courts. The point, according to The Federal Courts’ Official Website (https://www.uscourts.gov/statistics-reports/bankruptcy-courts-and-cases-journalists-guide) , is to consider giving the person or business that is in debt an opportunity to be relieved of all or part of that debt or to repay it in a different manner.

Appeals – the losing party in a case requests that it is reconsidered.

okay, SIDENOTE is over.

State Level

Court Listener, noted above, should be your first step for state courts because if it works you can avoid searching for the specific court database.

The National Center for State Courts maintains a list here of state websites for publicly available state courts’ records.

County Level

One can find individual county websites for county-level court records at Black Book Online. Just click on “County Public Records” at the bottom of the page, then choose the relevant state from the list that appears and then choose the county.

Researching U.S. Property Records

Property records can be found in deep web databases that are located in the local county government websites in the “County Tax Assessor” section under the heading “Property Search.” This is true for the vast majority of U.S. counties.

A quick way to find the database is to google the name of the county and “tax assessor,” because the county tax assessor maintains the records. This should lead you to webpage in the county government website where you have the option to input an address.

A directory of all of these U.S. county tax assessor databases can be found at Black Book Online.


The best source for this information is the Public Accountability Project. This website allows you to conduct one search in one place, and most importantly it also gives you the ability to search on a name. The county tax assessor databases only allow you to search on the address, which is obviously limiting if you do not have the address.

Find Email Addresses Linked to U.S. Phone Numbers

One issue that can arise when you are researching an individual living in the U.S. is the Phone-Email Divide. If you have a phone number, at least in the U.S., you can use various people-searching websites to find additional information like the name and address. Similarly, an email address can be used to find affiliated social media accounts. But it is difficult to connect a phone number to an email, or vice versa. This post is about how to cross that gap between phones and emails.

The answer is to first use the email address to find a social media account that reveals the owner’s name. Once you have a name you can search it in a people-searching website that will find the phone affiliated with that name. This process also works in reverse.

People-Searching Websites

There are five people-searching websites in particular that can be used for this process. Each website has its own inputs (data you can search on) and outputs (results).

It is important to note that if you do not want your personal information listed on these sites, they each have an “opt out” option available.

True People Search (truepeoplesearch.com) is by far the most reliable site for researching a phone number. The site uses name, address, and phone number as search inputs or outputs. The site will sometimes give the person’s email as an output.

That’s Them (thatsthem.com) and Search People Free (searchpeoplefree.com) are not always consistent with their results but they use name, address, phone, and email as inputs and outputs. These people-searching websites have the obvious potential to solve the whole problem by linking a phone directly with an email, thus negating the need for the rest of this process. Therefore, it makes sense to start with these sites.

Xlek.com and Radaris.com will only let you search by name to find the phone, but not let you search in reverse. Public Email Records (publicemailrecords.com) uses email, name, and address as both inputs and outputs.

Email to Social Media

There are several guides for using an email account to find affiliated social media accounts. Specifically, there are three methods (see linked guides that are effective as of September 2020) to do a reverse search that will find if an email address is affiliated with a LinkedIn page or Facebook account. Presumably/Hopefully the social media accounts will enable you to find the owner’s name. And of course it is always a good idea to just Google it.