In This Issue
Operations and Training: Operation Support, Texas and Oklahoma
Skullery Anniversary: One Year of Skullery
OSINT Tradecraft: Vehicle OSINT
Who We Are
The Skull Games Task Force employs Open Source Intelligence to IDENTIFY sexual predators and their victims, enabling law enforcement to INTERDICT the cycle of abuse. Our mission is to liberate survivors and EMPOWER them with the opportunity for a life of hope, healing, and freedom. The Task Force provides direct support to law enforcement through small teams or as a massive expedition, bringing together the collective capability of more than 400 elite volunteers. This counter-sexual exploitation offensive leverages considerable expertise and resources to fight human trafficking and sexual exploitation. With us as the HUNTERS, we get into the heads of predators, in our own “SKULL GAME”…
November Operations and Training Recap – November 2025
by Olinda Cardenas
- Predators Arrested: 22
- Victims Recovered and Offered Assistance: 8
- Individuals Trained in Countertrafficking: 15
In November, Skull Games continued to extend its operational reach by providing intelligence-driven support to law enforcement partners across multiple states. Through a combination of remote assistance and in-person collaboration, the team helped identify victims, disrupt buyers, and strengthen ongoing investigations targeting exploitation and trafficking.
Remote Operational Support:
Throughout the month, Skull Games provided remote support to multiple agencies, enabling investigators to act quickly and decisively using real-time intelligence.
In Tulsa, Oklahoma, the team supported the Tulsa Police Department, contributing to the recovery of two (2) victims. In Roland, Oklahoma, Skull Games assisted the District 27 Drug and Violent Crimes Task Force, resulting in six (6) victims being recovered. Additional remote support was provided to the Saraland Police Department in Saraland, Alabama, during a victim recovery operation that led to seven (7) buyers being arrested.
These remote operations demonstrate the effectiveness of intelligence-led collaboration. Intel Analysts working off-site were able to support live investigations, validate leads, and assist law enforcement in identifying offenders and victims, expanding operational capacity without geographic limitations.
In-Person Support: Childress, Texas
In addition to remote operations, Skull Games provided in-person support in Childress, Texas, where we worked alongside local law enforcement during a two-day operation. The operation resulted in three (3) arrests for Solicitation of Prostitution. A fourth arrest included charges of Solicitation of Prostitution of a Minor, Solicitation of Prostitution, and Failure to Comply with Sex Offender Registration. This operation highlights the value of direct collaboration with trusted partners on the ground, particularly in complex cases involving repeat offenders and registry violations.
The November operations reflect Skull Games’ continued commitment to scalable, intelligence-driven support for law-enforcement agencies nationwide. Whether we are operating remotely or in person, the team’s efforts helped recover victims, disrupt demand, and reinforce investigations that will continue to move forward through the justice system.
Skullery Anniversary
by Olinda Cardenas
It has been exactly one year since we launched this blog to shine a light on the unsung heroes of the OSINT world and the relentless fight against human trafficking. Over the past 12 months, The Skullery has been your window into the dark underworld we investigate and the inspiring community that fights back. As we mark this milestone and approach the end of the year, we want to reflect on Skull Games Solutions’ mission and look back on one year of Skullery.
For the past year, The Skullery has documented the evolution of our tradecraft, the bravery of our members, and the success of our operations. Whether you missed an issue or want to revisit a specific technique, here is a recap of the last 12 months.
Skull Games Task Force Member Highlights
The heart of Skull Games is our people—survivors, veterans, and volunteers who dedicate their time to the hunt.
- Will Mechler: We highlighted his transition from law enforcement veteran to Task Force Unicorn and tech expert. (November 2024)
- Julie Beck: The powerful “Survivor to Hunter” story of a member turning her pain into purpose. (April 2025)
- Joe Scaramucci: Highlighting his transition from a legendary human trafficking detective to our Director of Operations—out of the badge, but not out of the fight. (June 2025)
Tradecraft & Training
OSINT is a perishable skill. Over the last year, we’ve shared tools and techniques to keep our hunters sharp.
- Bypassing Paywalls: Techniques using archive.is and removepaywall.com to access information. (November 2024)
- Free People Search Tools: Deep dives into USPhonebook, WhatsMyName, and Dorksearch. (December 2024)
- Catfish Identification: Expert advice from Ritu Gill on spotting fake personas. (January 2025)
- Geolocation: Challenges and techniques from the SANS OSINT Summit. (February 2025)
- Toolbox Review: Evaluations of PimEyes, FaceCheck.id, Maltego, and Shodan. (March 2025)
- Professional Research: “The 10 Deadly Sins” of OSINT and professional research standards. (May 2025 & July 2025)
Events & Expeditions
When the Task Force deploys, results follow. Here are the major operations from the last year.
- Expedition XIII – Alabama: A massive effort resulting in 7 victim recoveries to close out the year. (November 2024)
- Expedition XIV – West Virginia: Tactical driving at Summit Point and 23 predator arrests. (January 2025)
- Super Bowl Support: Operations in Mississippi and Louisiana during the big game, netting 33 arrests. (February 2025)
- Expedition XV – Tampa: A flagship event supporting operations in Florida. We identified 36 victims and 20 persons of interest. (May 2025)
- Summer Operations: Extensive work across Alabama (ICAC), Oklahoma, and Arkansas, including a massive fentanyl and trafficking bust. (June 2025 – August 2025)
- Expedition XVII – Dallas: Our end-of-year deployment and the First Annual Skully Awards. (September 2025 & October 2025)
Read all past articles at The Skullery Archives
Skull Games 2025
The demand for our work has accelerated significantly. Law enforcement agencies are requesting more support than ever before, and our analysts are identifying more victims, more predators, and more actionable intelligence to meet that call. The numbers speak for themselves. In 2025 alone, compared to the previous year:
- Predator arrests supported are up 199%
- Victim recoveries are up 209%
- Predators and victims identified online and referred to law enforcement are up 133%
At the same time, our operational tempo continues to expand nationwide. Continuing at this pace requires support from those who believe in this mission.
Skull Games 2026
To sustain and strengthen this mission in 2026, we are asking for your support before year-end. Skull Games Solutions is needed, and to meet that need, we must be resourced.
Your contribution directly fuels:
- Investigative operations and Task Force deployments
- Real-time intelligence support to law enforcement
- Advanced Human Trafficking Training for agencies nationwide
- The organizational infrastructure that keeps this mission moving forward
If this work matters to you, I invite you to make a year-end contribution today.
Thank you for standing with us and strengthening the mission.
OSINT Tradecraft: Vehicle OSINT
by Tom Phelan
Remember those early-2000s commercials with the weird, anthropomorphic fox yelling at a car dealer to “SHOW ME THE CARFAX”? The premise was to make sure the vehicle you were buying didn’t have a history of damage or odometer fraud. Today, CARFAX and similar tools are used by OSINT practitioners to identify persons of interest by their vehicles.
Unlike facial recognition or social media identification, which can be pretty complex, vehicle identification is generally straightforward—make, model, and color are easily distinguishable at a glance. The VIN, license plate number, and registration state are all displayed on the exterior for anyone to see. Due to the extensive bureaucracy involved in car transactions, every sale, service, inspection, insurance, or registration leaves a paper trail. Also, something like 75% of crimes involve a vehicle in the report, making this a crucial intelligence discipline for law enforcement. For skilled analysts, this trail can directly reveal a target’s location, habits, or even their true identity.
This discipline of vehicle OSINT offers many utilities. For instance, if you identify a possible person of interest (POI) in a photo or video featuring a car, you have a new lead. Rare or expensive cars are often displayed as status symbols, like money or jewelry, which can make it easier to track down a POI. Criminals are rarely as discreet as you might give them credit for, so don’t be surprised to see their pricey car flaunted on social media. Even discreet criminals can make mistakes with their vehicles since it’s difficult to hide a vehicle’s history, registration, and insurance. They might even have vehicles registered with their illicit business.
There are even practical personal uses for this knowledge. Once, a Skull Games Task Force member received community support when the new car they purchased was never delivered. The dealer said it was “stuck at port” for three months, at which point you have to wonder if your car was lost, stolen, or sold to someone else. By running the VIN through our vehicle OSINT workflows, analysts determined if the car had been recently registered or insured in the destination country. Or maybe you’re the type of person who wants to investigate everyone who cuts you off in traffic. Whatever your purpose, the guide will kickstart your vehicle OSINT abilities.
Scenario 1: You With a VIN or Plate Number
A VIN is a 17-digit vehicle identification number. This piece of data tells you a lot in itself, including the vehicle type, origin, and year. If you have a VIN or plate number, you can use that data to pull a vehicle history report or public records, which, for us, means dates and locations to build a pattern of life.
Sometimes these reports will reveal the vehicle’s previous ownership or its current location. Most of the time, personally identifiable information is protected by law, and you will need to conduct some analysis. For example, accidents can provide a timeline for the vehicle. Service records can help geolocate as well; for instance, if a car is serviced at the Phelan Ford Dealership every 5,000 miles, it has a general, persistent location. If the odometer jumps from 20k to 50k miles in six months, you’ve identified a long-distance commuter or a commercial driver.
Vehicle History Report Tools: These are our top tools for getting vehicle reports, but there are plenty of sites that do vehicle reports and public records. The reports almost always cost money unless you are a dealership or law enforcement. I feel like they should be free, the US needs better consumer protection laws… Anyway, until we do a GoFundMe so I can subscribe to all of them, we won’t know which is the best, but these are a great start.
- CARFAX: The standard for service history. They also have a site dedicated to giving free reports to agencies and law enforcement. The fox still creeps me out, but that’s pretty cool.
-
- AutoCheck (by Experian): Pretty similar in quality and function to CarFax, but it also has auction data that others might miss.
- EpicVIN: A solid alternative that often provides VIN decoder information and sales history. It gives some details for free, but you can get the previous owner’s details with a subscription.
- SearchQuarry: A broad public records aggregator that can sometimes link VINs to people. Also does searches by plate, person, phone number. Once again, it requires a subscription or a pay-per-report fee for complete vehicle reports.
- National Insurance Crime Bureau: Can tell you if a vehicle has a report of theft or loss. Has a five-search-per-day limit.
Plate to VIN Pivot: To obtain a vehicle report using just the license plate number, you can leverage ‘Plate-to-VIN’ APIs, which retailers and insurers such as O’Reilly, AutoZone, and State Farm commonly use. By entering the license plate into tools like “Get a Quote” or “Find a Part,’ the system often provides detailed information, including the exact trim, engine type, and VIN.
VIN to Identity Pivot:Rental car portals like Enterprise or Hertz usually have a “Find My Receipt” tool. By combining a last name with a partial VIN or license plate, you can sometimes pull up the full billing address and phone number from a service record. This hack can also work with repair shops.
Plate to Pattern of Life: Many cities have public parking ticket portals. Searching a plate here shows if and where they get tickets. If a car has five tickets on Chestnut and Broad Street, you’ve found their workplace or some other pattern of life.
Google It: I probably should have started with this. The VIN or license plate could be free text in a public police report, on an auction site, social media, in leaked data (March 2021 ParkMobile breach exposed the personal information of 21 million customers, including email addresses, phone numbers, and license plate numbers), or in a forum post. So, take what info you have and see if it is out there in multiple search engines. Also, search pictures, not just webpages. Most image search engines can do text-to-image searches. If you have the full VIN or plate number, there will probably be only a few results. For a partial ID, try these dorks:
intext:”VIN” intitle:”service record” filetype:pdf
“license plate” “make” “model” filetype:xls site:.gov
intitle:”police report” “vehicle” “VIN” filetype:pdf
site:copart.com inurl:lot
site:.gov “parking citation” filetype:xls
Scenario 2: You Only Have a Photo
Sometimes you have a picture of the POI’s vehicle but no current license plate. Not a great start, but there is still a lot of analysis we can apply to this. Start with a reverse image search with something like Google Lens. There are apps available to improve the resolution if the image is blurry. You also want to include a text search query with everything else you know about the vehicle, like what town you think it’s in.
Vehicle Identification AI:That weird little NYPD smart car is an example of a unique vehicle; sometimes it’s not that easy to identify. If you can’t tell what kind of car it is, as they all start to look more and more alike, use Carnet.ai. It uses AI to identify the make, model, and year from images with incredible accuracy.
Trim & Badging: Remember every car has a model and sub-model (e.g., a Honda Accord Sport vs. LX). Figuring this detail out narrows the search significantly. Identifying unique wheels, spoilers, or chrome trim narrows your search from thousands to dozens of a specific subset.
The Dealer Frame: People rarely change the plastic frame around their plate. If a car in Vegas has a Phelan’s Ford Des Moines frame, the target likely has roots in Iowa or a previous residence there.
Stickers: Sometimes people unwittingly geolocate their car by slapping a Wired 96.5 FM or OBX sticker on it. Even an I Love My Pug or RIP Whoever personalized sticker can tell us something useful.
You will need to get good at this portion if you want to master vehicle OSINT. The next step is trying to identify the car on the street in Google Street View. You’ll notice that, if you go to Google Street View, it now automatically blurs faces and license plates. Therefore, you will need to learn to identify vehicles by other features.
Scenario 3: Tech Signature
We are getting deep in the weeds now with advanced OSINT. Modern cars are mobile computers that broadcast their presence via Wi-Fi and Bluetooth. The internet is full of tools that crowdsource this info.
Wigle.net: Most modern vehicles have built-in Wi-Fi hotspots, such as FordPass Connect. These have unique MAC addresses or BSSIDs. Using Wigle.net, you can search for a vehicle type’s Wi-Fi signal to see where it has been geolocated. The same goes for Bluetooth signals. Your car has a strong Bluetooth signal that broadcasts as a device usually unique to your vehicle manufacturer. You can track vehicles by brand using services like Wigle, based on the MAC address. For example, if I go to the MAC address registry, the IEEE Registration Authority, and look up Ford Motors, I can see that their vehicle MACs start with 00-26-B4.
Telematics: For advanced technical practitioners, understanding vehicle cybersecurity reveals how telematics and infotainment systems leak location data via public-facing APIs. Think of your concept of vehicles being lowjacked, like cop cars and shipping company semi-trailers. Those telematics, basically just the GPS location, should be secured but can be leaked, hacked, sold, or farmed. Here’s the kicker: your telematics are being farmed and sold, and you agreed to it. Your car manufacturer and insurance company sell your location data to data brokers or whoever wants to buy it. I am guilty of this as well, because I like that USAA discount on my insurance. Knowing full well that my location, device usage, and driving habits are sold to whoever wants to buy them. So it may not be conventional Publicly Available Information considered ethically available to OSINT practitioners. Still, everything has a price tag nowadays, including OSINT tool subscriptions, news articles, and vehicle history reports.
Hey, look, we made it through this, learned a lot, and without me saying, Dude, Where’s My Car? Happy Holidays and stay SKULLY.
Upcoming Events
- Task Force Expedition XVIII | January | West Virginia
Skull Games Links
- Social Media: Follow Us Linkedin Facebook Insta Twitter
- Donations: Support Us
- Law Enforcement: Partner With Us
- Volunteer: Join Us
About the Author
Tom Phelan is an active-duty U.S. Army Intelligence Officer with over five years of experience in OSINT and a dedicated volunteer for Skull Games Task Force.
Olinda Cardenas is a former crime scene investigator turned cybercrime enthusiast. She specializes in OSINT and financial crime investigations and is a dedicated volunteer with Skull Games
