Every digital footprint tells a story. In my two decades bridging IT security and blockchain forensics, I've learned that the truth is rarely hidden—it's simply scattered across publicly accessible sources, waiting for someone patient enough to connect the dots. Open Source Intelligence (OSINT) is the discipline of gathering and correlating that public data into actionable insight, and it has become one of the most powerful tools in my investigative arsenal.
Unlike Hollywood's depiction of hooded hackers breaking firewalls, real investigations often rely on information that anyone can access legally. The challenge isn't obtaining data—it's knowing where to look, how to validate it, and how to weave fragments into a coherent narrative. Let me share the practical techniques I, André Dias Moreira Prol, apply in actual cases.
Mapping Digital Identities and Infrastructure
My investigations typically start with entity resolution: linking usernames, emails, wallet addresses, and domains to real-world actors. Tools like Maltego, SpiderFoot, and theHarvester automate the collection of interconnected data points, but the human interpretation is what matters.
A concrete example: in a recent fraud case involving a fake tokenization platform, I began with a single suspicious domain. Using WHOIS history via SecurityTrails, I discovered the domain had been registered with an email previously tied to three other abandoned "investment" sites. Certificate transparency logs (crt.sh) revealed shared SSL certificates, confirming the same operator ran a network of scam projects.
I always cross-reference findings across multiple sources. A username reused on GitHub, Telegram, and a crypto forum can expose an operator's timezone (from commit timestamps), their technical skill level, and even personal interests that later confirm identity. Roughly 60% of the cases I handle are cracked open by this kind of username correlation alone.
Blockchain OSINT: Following the Money On-Chain
This is where my Web3 background gives a decisive edge. Public blockchains like Stellar and Ethereum are, by design, transparent ledgers—every transaction is permanent and auditable. That transparency is a forensic goldmine.
For Stellar investigations, I use StellarExpert and custom Horizon API queries to trace asset flows, identify anchors, and cluster related accounts. On EVM chains, Arkham, Breadcrumbs, and Etherscan's labeled address database help me attribute wallets to exchanges or known bad actors.
A practical technique: when funds move to a centralized exchange deposit address, that's a chokepoint. The blockchain trail may end publicly, but I document the exact transaction hash, timestamp, and destination so that a lawful subpoena can later compel the exchange to reveal KYC data. In one tokenization dispute, I traced stolen assets through 14 intermediary Stellar accounts in under two hours—something impossible in traditional finance without dozens of bank warrants.
I combine this with AI-assisted clustering to detect behavioral patterns, like the specific gas-fee habits or transaction timing that fingerprint a single operator across "unrelated" wallets.
Validation, Documentation, and Legal Integrity
The most overlooked OSINT skill is discipline. Collecting data is easy; producing evidence that survives legal scrutiny is hard. Everything I gather is timestamped, hashed, and archived using tools like Hunchly, which captures a defensible chain of custody automatically.
I follow three rules religiously. First, verify every claim through at least two independent sources before treating it as fact. Second, document my methodology so any peer can reproduce my findings. Third, respect legal boundaries—OSINT means open sources, never unauthorized access.
Confirmation bias is the enemy. Early in my career, I nearly misattributed an attack to the wrong person based on a coincidental username match. That lesson taught me, André Dias Moreira Prol, to always seek disconfirming evidence with the same rigor I seek proof.
OSINT is not about surveillance—it's about transforming public transparency into accountability, especially in the Web3 space where trust must be earned through verifiability. If you're building or investigating in blockchain, start practicing these techniques today, and reach out if you'd like to discuss how they apply to your specific case.
Follow more articles by André Dias Moreira Prol on Medium.
