Google Dorks – Key Findings

I love cars and I love OSINT. Sometimes I get to combine these passions. Not only for work, but also in little exercises that help sharpen my research skills.

A while back I posted a blog about using car spotting sites to find and track vehicles. The sites I discussed in that article where only the tip of the iceberg when it comes to finding information about specific vehicles online. Today, I want to walk you through other means of finding cars using unique identifiers such as license plates or VINs (vehicle identification numbers). There’s nothing fancy about what I’m going to show here. I’ll just follow the digital breadcrumbs using simple OSINT techniques.

For some reason I stumbled upon a Youtube video showing an Italian soccer player’s Ferrari. We’ve all been down that rabbit hole before. You start watching Youtube videos about cooking and end up somewhere completely different. Oh, the joys of the internet…

This video had a visible license plate and I was curious to see other places the car was spotted. My usual car spotter websites actually came up empty handed, no matter how I tried to enter the license plate number. So I took my search back to Google. Search engines actually OCR some of the images they index, so I entered the plate number and instantly received some results:

Next to the Youtube video that got me started, I found a blog in which the author posted multiple pictures of the car I was looking for. The plate number wasn’t listed anywhere as text on the website (checked through the developer tools as well: nothing came up), so Google must have OCRed it. Thumbs up to Google for this!

But wait, it gets even better. Google is not the only platform to OCR images, Facebook does so as well. So, I decided to take my search to Facebook and see if I could find further images of the vehicle there. Using the standard Facebook search, I entered the plate number. Keep in mind, throughout each search you might have to use different variations, adding spaces between characters or writing everything together.

The picture results are shown right away, as I have a direct hit in this query. Sometimes the picture results will not be shown in your main search results and you may have to click on the tab to the left to get to the image filter. Some guy on Facebook posted the Ferrari as his profile pic in April this year and this picture looks like it had the car at a repair shop or possibly a dealer.

Now, if this theory was right, the vehicle might not even belong to Leonardo Bonucci anymore. I could go looking for sales ads for such a vehicle and hope to find it. A lot of this would just be Googling and browsing through sales sites and would require a lot of tenacity and also a little bit of luck. Although, I still have an ace up my sleeve when it comes to Italian vehicles. This ace would allow me to find out more details on the Ferrari I was searching for.

I have a little app on my phone called iTarga. With this app, I can enter any Italian license plate and will receive further information on the vehicle. Here in Italy, vehicles are assigned license plates for life. Even if the car is sold, it keeps the plate numbers. Let’s see what iTarga tells me about Leonardo Bonucci’s Ferrari.

First date of registration, a VIN, insurance information (including insurance company and policy number) and the residence of the owner are among the things that can be found in the app. In our case, no insurance is listed. It is likely that the vehicle is not insured at the moment, adding to my suspicion that it is/was for sale. The owner’s residence is Milan, which happens to be the city Bonucci played in at the time most of the previously seen images were taken (he’s moved on to Juventus Turin now). These details give me further pivot points for my search. I could narrow down the results of sales ads to 2013 models and look in and around Milan or Turin (assuming it would be sold there). Or I could just simply Google the VIN.

Et voilà, I do receive results for sales ads. However, the vehicle offered here is a red Ferrari. I thought I was looking for a black one. And nowhere on the website can I find the VIN. See, zero results:

Yet again, a simple OSINT technique will help clear this up. Looking into the developer tools will enable you to search within parts of the website that aren’t directly visible to users. When checking the VIN there, I found that all uploaded images actually have the VIN in the file name.

Not only that, the URL also contains the VIN:

A little more research and everything makes sense. Bonucci originally drove the red Ferrari and had it wrapped in black foil. For the current sale, the black foil was apparently taken off again.

While this example utilized an Italian app, there are many similar sites for countries throughout the world (except in Germany…). The lesson to be learned here is to follow the digital bread crumbs. Sometimes seemingly simple OSINT techniques will lead you to your goal if you know how to combine them. And now you get an idea of how I spend my time when sitting in the passenger seat while my wife is driving. Googling license plates, checking car spotting sites and tracking the history of random exotic cars I see.

MW-OSINT / 16.10.2020

Looking for specific car? Next to googling it, you could try a car spotting site to find pictures that might provide further leads for your OSINT investigations.

A while back, @Wondersmith_Rae wrote a great article on maritime OSINT. In this, vessel tracking sites were mentioned, which allow us to identify ships and monitor their movements. Wouldn’t it be neat to have something similar for cars?

While we will never be able to track and identify cars just as good as we can track large ships, this article will provide some useful hints that can help with OSINT on vehicles. But which data is relevant when researching cars and motorcycles? As most vehicles are mass-produced, research based solely on the manufacturer, model and color might be a bit challenging. So, we will need unique identifiers such as the VIN or license plate.

The VIN, or vehicle identification number, is a 17-digit code which is assigned to every vehicle when it’s manufactured. The are several paid databases that will enable looking-up a VIN and retrieving information on the vehicle and possibly its history. If you don’t want to spend money, just try googling the VIN. Since it is so unique, you probably won’t receive a lot of results and thus not many false positives.

One of my favorite free sites to obtain information on VINs and vehicles in the US is Poctra. This site crawls the web for salvage vehicles and archives all available information and pictures. Let us see what Poctra reveals on the VIN I had googled.

High-res images, the location of the auction, mileage and sometimes even a license plate. There are plenty of pivot points to conduct more OSINT here.

If we have a license plate, and the car is something a car spotter might take interest in, we might find images of it on various car spotter websites. Next to PlatesMania, my favorite site is Autogespot. Both allow to search by license plate.

Enough theory, time for a practical example. Arsenal London football player Pierre-Emerick Aubameyang was often seen with a Ferrari LaFerrari. Even though he lives in London, this vehicle does not carry a British license plate. A great repository of license plates can be found at World License Plates, in case you have to figure out which country the license plate originates from first. It turns out that Aubameyang’s Ferrari is registered in Germany. His license plate is AIB-Q 1414. Let us see if we can find this car on Autogespot.

By clicking on “More Filters” on the top right of the website, we can define our query.

This leads to several results, each containing multiple high-res images. Not all images are publicly accessible if you are not a paying member of Autogespot, but there is a workaround to retrieve the pictures hidden behind the paywall. We’ll get to that in a minute.

The top left entry shows that Aubameyang’s Ferrari was spotted in London on 21 September 2019 and that this sighting contains 10 pictures. The spotter also links his Instagram account, which might lead to further images. So, make sure you always pivot your investigations to these additional profiles as well.

Sometimes, we can retrieve the other pictures from Autogespot even without paying for a premium account. Just copy the URL of the page you are on and query it in Google. Then have a look at the image results. Here are the other nine images:

The information we now obtained is once more useful as a pivot point for further investigations. Maybe we can geolocate the exact location the vehicle was parked at and thus know where Aubamayeng was on 21 September 2019 after lunch. Maybe these pictures could provide evidence that a vehicle was damaged prior to a current insurance claim. There are many reasons why tracking and identifying vehicles may be useful. When researching license plates, keep in mind that a simple search engine query or query within social media might also lead to results. In our case, it leads us to results on Twitter, Instagram and press articles, next to the car spotter sites we have looked at already.

There are plenty of other platforms worldwide that track vehicles and allow queries by license plate, another one of my personal favorites is Nomerogram (Номерограм) in Russia. This site not only displays luxury cars, but also every-day, ordinary cars. I guess this is related to Russian’s love of dashcams, resulting in a massive amount of video and imagery on all kinds of traffic participants.

With the techniques and sources shown above, a vehicle can be manually tracked to a certain extent. This tracking, however, will rely on geolocating the image. To practice this, I recommend participating in the @quiztime geolocation challenges on Twitter. In a future blog article, I’ll look at Wigle and see how this platform could help track cars as well.

Until then, have fun looking up exotic cars on the aforementioned sites. That is, unless you prefer going through pictures of banged-up, rusty Ladas on Nomerogram. Hey, I’m not judging!

MW-OSINT / 07. December 2019

Tag: Google Dorks

Where is Leonardo’s Car – Using OSINT to trace vehicles

Car Spotting and OSINT