I found the username Joel Greenberg, the embattled tax collector and pal to Florida Congressman Matt Gaetz, used to review sex workers. I’m going to show the steps I used to find it as the techniques are great tools in fighting disinformation and harassment but also a warning about your own personal safety online, even if you don’t plan to engage in criminal activity.
The first piece of information that lead me to find Joel’s account was his previous Twitter names. Twitter, like most social media, has an account id assigned to each account. The ID is a series of numbers, that way when you change your username the account persists as the username is just a facade on the ID. I’ve yet to find a clean database of name changes, instead you have to use some sideways techniques to find previous usernames.
A slow but easy way to find those previous names is to use twitter search to look for tweets to the account you are interested in. You can delete your own tweets but, as much you may wish you could you can’t delete or hide other peoples tweets to you. Twitter’s search operators, the list of search commands exposed to users, are incredibly powerful. In this case I used the “until:” date operator and the “to:” operator to find tweets to Joel Greenberg that showed previous handles he had be tweeted at.
In this tweet search narrowed to no tweets before Jan 1st, 2019 he was using his current user named of JoelGreenbergTC
Amended the search to before 1/1/2018 and you find the second username he had used, JOELGREENBERG
2017 gets us a 3rd: __J_O_E_L__G
2014 he was @_JoelGreenberg
and finally in 2013 he was @Joel__Greenberg and @jmg2485
JMG2485 is Joel’s initials, Joel Micah Greenberg and his probable DOB 2/4/85, tho many sites list it as 2/4/84.
The next piece of information I found was from his WHOIS, a database of website owner information. When purchasing a website you are required to enter your address, name, a phone number, and email. Many people choose to use a proxy service for this, think of it like a P.O. Box for this information, because it keep their phone number off the open web. Joel owned multiple website and chose not to use a proxy service, exposing his information.
From one of the first filings from the government against Greenberg he was at one point running a media/internet company
One of the sites Greenberg owned was “OrlandoSugarDaddy.com”. He only ever built out the front page and the images and user names are actually hot linked, meaning he didn’t actually buy or host them but instead is using them without permission from another site.
In general you are only able to pull the WHOIS for the current owner of a site without a paid account to a site that keeps historical records. Twitter user Out5p0ken used one of those tools to pull the account for Orlando Sugar Daddy
In the screenshot for the WHOIS is an email, greenbergjoel@icloud.com. Because WHOIS contain emails there are many tools to find all the same sites registered to the same email, assuming no proxy service is used. I ran one of these reverse WHOIS services and found “Taxcollector.us” has been registered to the same address. Joel Greenberg is a common name but a Joel Greenberg in Florida interested in running “sugar daddy” and tax collector websites is narrow
From there I pulled the WHOIS for taxcollector.us and found the phone number and address associated with it. I searched the phone number and found a site that had information collected about Joel
A question you maybe asking yourself is where and how do sites like this get this information? When you sigh up for text messaging services, emails, buy things online, get a customer card at a store, etc… you give multiple pieces of information: name, age, phone, email, address. Often those companies sell that data on to data brokers who compile it all and cross reference it. Even if you used a different email for each service you use if you use the same phone number they will figure out how to link them. In fact the Cambridge Analytica data in 2016 was sourced from some of these data brokers. Opting out is optional but most people will not realize this is available.
Back to the list of usernames for Joel, I blanked the top few because again due to cross listing they appear related to a relative of his he shared an address with and not his, again this is due to data brokers trying to match matching fields. However Chronic2485 matches the same pattern JMG2485 that we know he used on Twitter.
A google search for Chronic2485 didn’t produce too many results
The first result is for “Stocktwits” a stock information network that started out running on top of Twitter before branching off to be its own service.
A quick search of twitter shows there was a Twitter user with that name but, there account no longer exists and I can’t find traces of it
We know Joel Greenberg used 2485 in his user names and was interested in investing topics
Now further down in the google searches are these two links
An escort Review Site with reviews by a user named chronic2485
The reviews require paid access to view. From the little bit of preview text it appears to reveal a username of someone else, possibly another man, who Greenberg was with on at least one of the encounters.
Now so far my proof tying Greenberg to Chronic2485 is a little light for my liking. My last step was to use of the sites that plugs a username into multiple site and sees were else that username has been used. In this case I used usersearch.org, and found a YouTube channel had been registered with the username Chronic2485 https://www.youtube.com/user/chronic2485
OH!
