Telephone Directory
This is going to save you a great deal of time and effort before we start looking into government records; and by that I mean committing a crime. Take the list(s) you’ve created from the previous sections and go to the phone book. No, not the paperbacks silly, these:
I personally go with the three at the top of the list, but you can use whatever you like. Search for what you have, and don’t forget to search every state you have. You might not find the person you’re looking for, but chances are you’ll see an address and possibly a phone number. Keep what you find.
Now, and here’s the fun part. Once you have Phone numbers, do a reverse search and don’t limit yourself to one Telephone Directory. Search them all, as many as you can. Run the number through Google as well, or the search engine of your choice. You’re trying to do two things here: First, to see if the address listed in the phone book has changed or to get one if you don’t already have it, and second; to verify that the number still belongs to that person.
Yes, this is a lot of work.
Google Maps and Street View
Take the address(es) you have and run them through Google Maps or any other Map service you like. Get satellite and Street View images for extra credit. Capture the images and store them with the dossier. Be sure to save the links to both Satellite and Street Views with your Screen Captures, and place the links with each address. We’ll be revisiting this later.
Take note of the make and model of the vehicle, security/alarm company signage, animals, and anything else. Be sure to zoom in and verify the address on the house- often Google is off by a few numbers.
Property Shark
This is one of the few paysites I’d bother signing up with. You get one free report, but you can always sign up with as many throwaway emails as you like and milk them for free. Still, I’d go with the Property Appraiser in the next section before I’d trust them. Still, some jurisdictions make you pay to see records, or require you to visit them in person. When all else fails, you can get a decent detailed report here for free or cheap.
Property Shark Website
Facebook
Facebook is a personal favorite of mine, and actually deserves its own section. I’m going to go into greater detail in a later paper, but for now it serves to mention that you can gather a great deal of information about a person’s interests, family and friends through Facebook. I hate it for personal use, but love it for gathering data.
Limited Datasets and Inaccurate Information
An interesting situations can arise when you have limited data. In one scenario, I was trying to locate a person named Marybeth, but didn’t have a lot to go on. I had a picture of her and knew her general interests, but didn’t have much else; I was flooded with an array of Marybeths as I searched through phone books and Public Record Pay Sites. I’d guessed her age as being mid-20’s, but I was coming up with nothing.
Enter Wolfram Alpha. Wolfram Alpha is a complex online database created and maintained by the Wolfram Research Company, the makers of Wolfram Mathematica.
Marybeth Wolfram Alpha Search
It is exceedingly useful at pulling up data on a number of things, especially names. If you scroll down to the section that says “History for US Births”, you’ll see a graph that illustrates the birth (used to estimate age group) statistics for every Marybeth born between 1880 and 2012. It also cites sources, and is very accurate. Birth names are a trend like any other, and they rise and wane in popularity just the same. Take a look at the year on the graph where the line drops off. What was my mistake? I was looking for a twenty-something year old that was actually thirty-something. With that hammered out, I found everything else very quickly.
Gathering and Confirming Sensitive Information
An explanatory note: Everything in this section is illegal. Do we give a fuck? Hell no. Why should we? I only mention it because it is unlawful to access government records with the intention of committing a crime- or at least it says so on every disclaimer page I ignore and click through.
Clerk of Courts
This is, bar none, the most important place for gathering information on the internet. You can get all sorts of goodies here- but you’ll need to do some research. First, let me give you a little insight as to how this all works.
The United States is divided into 50 states, and within each state are separate jurisdictions- either counties, parishes, or burroughs. Within each county (etc), incorporated municipalities comprise their own separate jurisdictions. Incorporated municipalities and townships have their own police force, but property, criminal, civil, and family court is all handled by the county.
Some states allow you to search for records statewide, some don’t. Some states have counties with limited to no online access, while other counties have state of the art records you can download as PDFs or TIFFS and others. If you have an address, you’ll know the city and state- you’ll need to look up the county. Wikipedia is your friend.
Once you have your county you can search by name, docket if you know it, or a few other methods. You’ll find a bunch of listings for Judgements, Agreements, Annulments, and documents of varying use. Grab them all, particularly Mortgages, Deeds, Marriage Licenses.
This is what they look like, but some jurisdictions differ slightly:
Marriage licenses always contain ( for both parties):
- Date of Birth
- Full Names
- State of Birth
- Mother’s Maiden Name
Mortgage Agreements and Deeds/Titles generally have this speech:
Grantor [Previous Owner] Grantee [Current Owner]
[Party 1’s Name], a (un)married man, and (if married) [Party 2’s Name], a married woman, are Granted the property at [Address] on this date of [Date] by [Party 3’s name]
You’ll want to confirm this with the information you have. You might find that they’ve sold the property and moved. Another thing to keep in mind is the fact that SSN’s are redacted on these documents, and often family court documents are censored or unavailable. Don’t be discouraged. These are not scanned into the server by hand, but are done in bulk by overworked bookkeepers.
They use pattern recognition software to find SSN’s, or redact them in places where they commonly appear . Sometimes the paper goes in at an angle, leaving a SSN only partially or entirely unredacted. If you know some of it, you can figure out the rest. Plenty of Public Records Pay Sites allow you to search by SSN for free, and try to get you to pay to see the whole record- but you always get the name. Only know 5 of the nine numbers? Brute force that shit. Why not?
Finally, you’d be surprised to see how many times I’ve found a SSN in places where it shouldn’t appear. I found one in the middle of a paragraph on a court document detailing a court case where a woman was charged with petty theft. It had no reason to be there, but it was. Just don’t give up.
Property Appraiser
I love the Property Appraiser. Few things say as much about a person’s net worth like the value of their home. Some of the older systems can be a bit wonky, but most allow you to search by name, address, and a few other listings. You can see floor plans, additions and the dates they were added, previous owners, and tons more. Some jurisdictions allow you to download the entire database, which I always do whenever I’m given the opportunity.
Remember when I said we’d revisit Google Maps? This is when we do it. The resolution at most CIS(or GIS, I forget) and related systems is crap. Make sure the house they own is the one you took a capture of. If it is, kudos; otherwise find the right one and grab some more pictures. I’d get as many angles of the house as possible- you’ll need them if you ever plan an entry…
Department of Corporations/Commerce
Every state has one. This is the state registry of businesses, be it a Corporation, LLC, Sole Proprietorship, Doing Business As(DBA) or Fictitious Name, or others. Look them up my Registered Agent Name to see if your guy runs it. The only problem is that not too many states allow you to access this without paying a fee or showing up in person.
Still, you can really get a good idea about your victim’s net worth if you know the value of his or her business and home. Also, you can use this information for Purchase Order fraud, provided you have or can make a letterhead for their business.
In the next part I’ll detail some of the hacks you can use to make money and/or completely fuck someone’s shit up for life with the information you’ve gleaned here.
ctfcybersecurity 
