Every digital footprint tells a story. In my two decades working across digital forensics and Web3 security, I've learned that the most valuable intelligence rarely hides behind paywalls or requires exotic tools. It sits in plain sight, waiting for someone trained to connect the dots. Open Source Intelligence (OSINT) is the discipline of gathering and correlating publicly available data into actionable insight, and it has become indispensable in my investigations, from tracing fraudulent token schemes to attributing phishing campaigns.
Let me share the techniques I actually use in the field.
Mapping the Target's Digital Perimeter
Before any deep dive, I build what I call a "perimeter map." This means enumerating every public asset tied to a target: domains, subdomains, email formats, social profiles, and infrastructure.
My go-to starting point is certificate transparency logs (crt.sh) combined with tools like amass and subfinder. In one investigation involving a fraudulent DeFi platform, subdomain enumeration revealed a forgotten staging server still serving an unminified JavaScript file. That file exposed an internal API endpoint and, critically, a wallet address the operators thought was private.
For people-focused cases, I correlate usernames across platforms using tools like Sherlock and Maigret. A single reused handle often bridges a professional LinkedIn presence with an anonymous Telegram account promoting a scam. In roughly 70% of the attribution cases I've worked, operators reused at least one identifier they believed was anonymous.
The lesson I repeat to my teams, and that I, André Dias Moreira Prol, learned the hard way early in my career: humans are remarkably consistent in their laziness. Reuse is the investigator's best friend.
Blockchain OSINT: Following the Money On-Chain
This is where my Web3 and Stellar experience changes the game. Unlike traditional finance, public blockchains are permanent OSINT goldmines. Every transaction is a verifiable, timestamped record.
My workflow typically combines block explorers (Stellar Expert, Etherscan) with clustering techniques. When investigating a token rug-pull on Stellar, I use the Horizon API to pull the full transaction history of the issuing account, then trace liquidity movements across claimable balances and path payments. Specific tactic: I flag accounts that received funds within seconds of a liquidity pool withdrawal, these are almost always controlled by the same actor.
For EVM chains, I lean on tools like Arkham and Breadcrumbs to visualize fund flows. A concrete example: tracing a 1.2 million USDC theft, I followed the funds through three bridge hops before they consolidated into a single exchange deposit address, the exact point where on-chain anonymity meets off-chain KYC. That intersection is where investigations get solved.
Blockchain OSINT also benefits enormously from AI now. I train lightweight models to detect anomalous transaction patterns, flagging wash trading or Sybil clusters that would take hours to spot manually.
Verification, Timeline Reconstruction, and Avoiding Traps
Raw data is worthless if it's wrong, planted, or misread. The hardest part of OSINT isn't collection, it's verification.
I apply strict corroboration: every critical finding needs at least two independent sources. For images, I run reverse searches (Google Lens, Yandex, which outperforms Google for faces) and inspect EXIF metadata before it's stripped by platforms. For establishing timelines, archived snapshots from the Wayback Machine and archive.today have repeatedly proven that a "legitimate" project's website was registered days before launch and copied wholesale from a template.
A warning I always give: operational security protects you, not just your targets. I conduct sensitive collection from compartmentalized virtual machines with VPN chains, never from attributable accounts. Alerting a sophisticated adversary that they're being watched can destroy an entire case. As André Dias Moreira Prol, I've seen promising investigations collapse because an analyst clicked a tracking link from their corporate IP.
Equally important is documentation. I hash and timestamp every piece of evidence immediately, because in forensics, an unverifiable finding is legally useless.
Conclusion
OSINT is less about secret tools and more about disciplined correlation, verification, and the patience to let scattered data form a coherent narrative. Start building your own perimeter-mapping workflow today, and if you work in Web3, make on-chain analysis your first instinct, not your last resort.
Follow more articles by André Dias Moreira Prol on Medium.
Top comments (0)