Whether you are an insurance investigator, working in law enforcement or supporting crowd-sourced OSINT investigations, e.g. with the National Child Protection Task Force, you will often come across vehicles in the cases you work on. There are many different approaches to find information on vehicles and sometimes also on their owners. This blog will show some of the resources you can use when conducting COSINT: OSINT on Cars (or any other motor vehicle). Keep in mind, that this blog will not include every source out there and that these sources may vary from country to country. And before I dive into some useful sites, one of the best tips I always have is: use OSINT to conduct OSINT. For example, if you are not familiar with anything that will allow you to look up a license plate in your country, just google it (license plate lookup, find infos on license plate, etc.) and try out different sites yourself. But here’s an overview of some of my go-to sources.
To start off, we first have to understand which vehicle data we can query online. Searching solely based on the manufacturer, model and color might not be the best option if it is a mass-produced vehicle. Each motor vehicle (cars, motorcycles, trucks) has several unique identifiers. The first being the Vehicle Identification Number, or VIN. This is a 17-digit code assigned to every vehicle. This code will give you the make and model and sometimes the manufacturing year as well as the overall specifications the vehicle has. For those interested in this, I recommend you start with the Wiki-page on VINs to understand more on how it is composed. Next up it is the license plate. This will lead back to the person or organization that has registered and/or insured the vehicle, although it will often not be able to research this information for free or through OSINT at all. I will mainly concentrate on some of the research possibilities in the United States, so here’s an overview of license plate designs in all 50 states. Oh, and since modern cars have all kinds of multimedia systems onboard, MAC-addresses, BSSIDs or Bluetooth-IDs might be another way to track down vehicles. But we won’t dive in that too deep yet.
Now, let’s start off with a little fictional case study. The following license plate popped up in our investigations. I’ve redacted information, since all case studies that I’ll use in this blog will be coming off real data.
The first step would be to simply google this license plate number. Next to possible text-based results, we might obtain image-based results, as Google and other search engines often use optical character recognition (OCR) to extract text from images. As always when using search engines, you might have to tweak the search a little, in our case that would mean writing the complete license plate number together (BXXXXX4), trying out adding blanks (BXX XXX4) or using quotes (“BXX XXX4”). While our query did not produce any text based results, we did come across an image of the vehicle from a local news article. This license plate number is not listed anywhere on the website and thus this result was presented to us by the OCR Google used on the image.
As I previously mentioned, there are also paid services that allow a license plate lookup. I’ve used Infotracer for this instance. I have found that many of these sites will greatly differ in the quality of the results, there is no ‘one size fits all’. My success rate on obtaining the name of a vehicle registrant is often beneath 15%. However, in the current case we’re lucky and are able to get a name and a VIN number.
With this name we could now search for the individual in search engines, people search engines and of course social media. The VIN can also be queried, but we’ll get to that a little later. What other possibilities do we have to track vehicles based on their license plates?
Car spotting websites might help here. That is, if the vehicle is something special, e.g. a luxury or super sports car. Most car spotting websites will only contain such ‘nice’ cars. Unless you are in Russia. For some reason, Russians love uploading and indexing just about any car and license plate. While the Toyota we investigated before cannot be found on such sites, let me give you an example of a license plate that can be found on one of my favorite sites Autogespot.
We’re not done with license plates yet! Just like search engines OCR images, social media platforms sometimes do as well. In Facebook, for example, you can use the search box to query any type of text you like. That means we can also query license plate numbers. To demonstrate this, I have queried one of Jay Leno’s cars. An awesome Ford GT registered under BK2LMNS. By clicking on ‘Posts’, we’ll receive results that contain BK2LMNS in the text.
Next up, we’ll go to the photo results. The images displayed here are sometimes shown because of correlating text in the actual post or a comment that contains our search term. However, Facebook does OCR images, so the result can often also come from extracted and indexed text. I’ve highlighted an image in the search results (top row, second from left) and looked at the actual post for this image and can confirm that there was no mentioning of the license plate number in the text, neither in the post itself or in any comments.
As you have seen, there plenty of possibilities to research license plate numbers. Now let’s focus on the VIN. You can obtain a VIN by looking up a license plate number through one of the paid services, as we have done in the example we had started with. Basically everything we have done above applies to VINs as well. For starters, just google it:
This will often lead you to auction sites and paid services. Some of the auction sites will only display a small portion of the data or only image previews. In this case, a deep dive into the developer tools in your browser might help reveal more useful information. Other times, merely manipulating the URLs might lead to further relevant data. I’m not going to go into details here, but Micah has produced a great 10 Minute Tip on using browser developer tools.
Interesting enough, Facebook might also come back with results on VINs through their OCR. Unfortunately, the full VIN is not often OCR’d and indexed, but this is something you can always try as well.
So now you’ve received a brief overview of what is possible when researching vehicles online. Not everything is possible everywhere, not everything is possible for free. And as you have seen, one data source leads to another and will enable you to pivot in your investigations. A license plate number leads to the registrants name, this person can be found on social media and more information on his or her activities could be found be there. A license plate number can also lead to a VIN and this could give you background information on the history of the vehicle (e.g. previous damages, etc.). If you would like to read about other fictional case studies regarding COSINT, please check out these two blog posts as well: