First a heads up

Small Group Webinar! Ask me questions!

Learn Crypto Investigation at my upcoming webinar!

Register at:

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

Introduction to Cryptocurrency Investigation

June 25, 2025 2:00 pm EST

This webinar will equip participants with the foundational skills to investigate Bitcoin and other cryptocurrencies, trace funds, and uncover crimes. By the end of the session, participants will be able to investigate addresses, trace fund flows, identify red flags, and interpret NFT behavior to support investigative or analytical work.

Hg’s expert trainer provides in-depth training on how look up and identify basic wallet data, understand blockchain transactions, recognize scams, detect suspicious online behavior and visualize transaction networks.

Register Now

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

Here are some of the most common symbols and visual cues that indicate someone is involved in the crypto, NFT, or blockchain space on social media:

1. Laser Eyes: As mentioned, this is especially popular among Bitcoin enthusiasts to show strong belief in its future value.

2. Diamond Hands: Represented by the diamond emoji and often paired with a pair of hands emoji, it signifies holding onto crypto assets despite market fluctuations.

3. Rocket Emoji: Used to indicate that a cryptocurrency or token is “going to the moon,” meaning a belief that its value will skyrocket.

4. NFT Profile Pictures (PFPs): Using an NFT as a profile picture, especially from popular collections like Bored Ape Yacht Club, CryptoPunks, or World of Women, is a strong signal of involvement in the NFT space.

5. Chain Emojis: Sometimes used to represent blockchain technology itself, indicating general support for decentralized technology.

6. Crypto Tickers: People often include the ticker symbols of cryptocurrencies they support in their bios or usernames, such as “$BTC” for Bitcoin or “$ETH” for Ethereum, signaling their investment or interest in those assets

7. Metaverse Avatars: Users involved in virtual worlds like Decentraland or The Sandbox often use avatars or in-game characters as their profile pictures, indicating their participation in these metaverse platforms.

8. Specific Emojis for Tokens: Some cryptocurrencies have their own dedicated emojis used by their communities. For example, Dogecoin supporters frequently use the Shiba Inu dog emoji.

9. Ethereum Diamond Emoji: The diamond emoji is often used to represent Ethereum, symbolizing the ETH token and its community.

10. “HODL”: This term, which originated as a misspelling of “hold,” is now widely used in the crypto community to indicate a long-term holding strategy. People often include “HODL” in their bios or usernames to show their dedication to holding their crypto assets.

These symbols and terms are widely recognized within the crypto community and can be helpful in identifying like-minded individuals or gauging someone’s involvement in blockchain and cryptocurrency projects.

First a heads up

Small Group Webinar! Ask me questions!

Learn Crypto Investigation at my upcoming webinar!

Register at:

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

Introduction to Cryptocurrency Investigation

June 25, 2025 2:00 pm EST

This webinar will equip participants with the foundational skills to investigate Bitcoin and other cryptocurrencies, trace funds, and uncover crimes. By the end of the session, participants will be able to investigate addresses, trace fund flows, identify red flags, and interpret NFT behavior to support investigative or analytical work.

Hg’s expert trainer provides in-depth training on how look up and identify basic wallet data, understand blockchain transactions, recognize scams, detect suspicious online behavior and visualize transaction networks.

Register Now

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

If your goal is specifically to identify the real name or social media account of a crypto wallet owner, here are the most common methods that lead to that level of attribution, based on open-source intelligence (OSINT) practices:

1. Wallet Posted on Social Media or GitHub

How it works: People often post their wallet addresses publicly for tips, NFT sales, giveaways, or development projects.

Where to search:

• GitHub: Look for wallets listed in README.md files, donation sections, or GitHub Gists.

• Twitter/X: Search for the full address or truncated forms (e.g., 0xAbc...123) in posts, bios, or replies.

• Reddit: Check crypto-related subreddits for tip jars or transaction screenshots.

Search Tip:

Use Google like this:

"0xabc123..." site:twitter.com

"0xabc123..." site:github.com

"0xabc123..." site:reddit.com

2. ENS (Ethereum Name Service) and Similar Name Resolvers

How it works: Many users register readable names (e.g., alice.eth) linked to their wallet. ENS records may include:

• Twitter handle

• Email address

• Website

• GitHub username

Where to check:

• Etherscan.io (paste address and see ENS if available)

• app.ens.domains

• whoisens.io

Red flag: Many people forget ENS records are public and leave real metadata.

3. NFT Platform Profiles

How it works: On platforms like OpenSea or Foundation, wallet owners often:

• Set usernames

• Link social media

• Display NFTs that tie back to public identities

Where to look:

• opensea.io

• zora.co

• foundation.app

What to search: Paste the wallet address into the platform’s search bar, or use:

• Zapper.fi

• Debank.com

These sites show NFT holdings and sometimes even usernames.

4. Search for Reuse of Wallet Address

How it works: If someone reuses the wallet address across different websites, you may find it:

• In a crowdfunding campaign

• On a personal blog or storefront

• In a doxxed leak

Search strategy:

• Paste the address into Google

• Search parts of the address ("0xAbC" or "123Ef"), as some forums or sites only display partial addresses

• Use site-specific searches for marketplaces, forums, and paste sites

5. Transaction Trails to/from Known Services

How it works: Many people receive payments from or send to platforms where identities are semi-public:

• Crypto exchanges (e.g., Coinbase, Binance)

• NFT marketplaces (OpenSea, Foundation)

• Mirror.xyz (crypto blog platform with author names)

You may be able to identify a wallet that:

• Receives regular payments from a known creator fund

• Paid a known wallet tied to a name

Use:

• Etherscan.io

• Breadcrumbs.app

• Arkham Intelligence (if access available)

6. Cross-Referencing via Blockchain Intelligence Tools

Tools like:

• Arkham (tagged wallets with social and real names)

• Nansen.ai (wallet labels and wallet cluster identities)

• Chainabuse.com (reports sometimes include names or aliases)

• WalletExplorer.com (Bitcoin wallet clustering, occasionally tagged)

These can show:

• Username or alias associated with a wallet

• Link to a Twitter profile or known influencer

7. Wallet Connected to a Domain or Website

How it works: Some wallets are embedded into websites (e.g., donation address in footer). You can:

• Use SecurityTrails.com or WHOIS to investigate the domain

• Archive the page via archive.org

• Cross-reference the site owner with the wallet

Small Group Webinar! Ask me questions!

Learn Crypto Investigation at my upcoming webinar!

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

Introduction to Cryptocurrency Investigation

June 25, 2025 2:00 pm EST

This webinar will equip participants with the foundational skills to investigate Bitcoin and other cryptocurrencies, trace funds, and uncover crimes. By the end of the session, participants will be able to investigate addresses, trace fund flows, identify red flags, and interpret NFT behavior to support investigative or analytical work.

Hg’s expert trainer provides in-depth training on how look up and identify basic wallet data, understand blockchain transactions, recognize scams, detect suspicious online behavior and visualize transaction networks.

Register Now

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

When investigating cryptocurrency transactions, it’s crucial to understand not only the technical side visible on a blockchain explorer but also the user experience behind those transactions. In this section, we’ll take a closer look at how a simple transaction appears on a platform like blockchain.com, detailing the sender, recipient, and amounts, all timestamped and permanently recorded on the ledger. But beyond the raw data, we’ll also dive into the perspective of those directly involved in the transaction. How do they initiate and complete a transfer from their mobile wallets? What does the process look like on their end? Understanding both views—the bird’s-eye perspective of the blockchain explorer and the hands-on experience of users—will offer a more comprehensive picture of how these digital exchanges unfold in real time.

Before we dive into the technical details of viewing transactions on a blockchain explorer, it’s important to understand how people typically engage with cryptocurrency in the first place. This foundational knowledge will help us better grasp how the activities seen on the blockchain are initiated and what actions they represent in the real world. Let’s start by looking at how individuals obtain and manage cryptocurrency, as well as the different platforms and tools they use.

We will first explore how people normally obtain crypto and use crypto. Specifically we will dive into the the process of getting crypto, the Apps and Wallet types, the exchanges that trade dollars for crypto, and how funds are sent and received. Finally, we will briefly touch upon Blockchain Explorers, which are the type of websites investigators use to view transactions.

How People Get Crypto

Most people get into crypto by setting up an account with a cryptocurrency exchange. Here’s how it usually works:

First, they choose a reputable exchange like Coinbase, Binance, Kraken, or Gemini. These platforms are popular for different reasons—some are super easy to use, while others offer a wider range of cryptocurrencies or advanced trading tools for more experienced users.

Once they've picked an exchange, they sign up by creating an account. This means providing an email and password. To comply with regulations, they’re usually asked to verify their identity, which involves submitting personal information and uploading a photo ID, like a driver’s license or passport.

Security is important, so the next step is setting up two-factor authentication (2FA). This adds an extra layer of security by requiring a second verification method, usually through an app like Google Authenticator or SMS, making sure their account is harder to compromise.

With the account set up and verified, they need to deposit funds. Most people do this by linking a bank account or using a credit card to transfer fiat currency like USD or EUR into their exchange account. If they already own cryptocurrency, some exchanges allow deposits in crypto too, making it easier to fund the account.

Once the funds are in, they’re ready to buy crypto. They go to the trading section of the exchange, select the cryptocurrency they want—like Bitcoin or Ethereum—and place an order. They can either buy at the current market price or set a limit order to buy at a specific price.

After the purchase, storing the crypto securely is the next step. Many people leave their assets on the exchange for convenience, but others prefer transferring their funds to a personal wallet for better security. Hot wallets (online) are more convenient, while cold wallets (offline) are more secure against hacks. Hardware wallets, which are a type of cold wallet, are particularly popular for long-term storage and extra security.

This is the typical process most people follow to get started with crypto: pick an exchange, set up and secure their account, deposit funds, buy crypto, and then store it safely.

What is a Cryptocurrency Exchange

A cryptocurrency exchange is basically a digital platform where you can buy, sell, and trade different cryptocurrencies, similar to how a stock exchange works but for digital assets. These platforms let you exchange cryptocurrencies like Bitcoin or Ethereum for other cryptocurrencies or traditional currencies like USD or EUR. When you sign up for an exchange, you'll need to verify your identity, usually by submitting a photo ID and proof of address. Once your account is verified, you can deposit funds using bank transfers, credit cards, or even other cryptocurrencies to start trading.

The main role of an exchange is to connect buyers and sellers, and they offer various tools to enhance the trading experience. You can place market orders, which fill immediately, or limit orders that only execute at a certain price. Some platforms, like Binance and Kraken, cater to advanced traders with options like futures and margin trading, while Coinbase is popular for its simplicity, making it ideal for beginners. Security is key—exchanges use measures like two-factor authentication, encryption, and cold storage to protect your funds. Many exchanges also offer extra features like staking or lending, allowing you to earn passive income on your crypto.

The Major Exchanges

Here’s a breakdown of the top four cryptocurrency exchanges with key details for investigators:

Coinbase: U.S.-based and has strict KYC/AML requirements. They’re known for working closely with law enforcement and provide detailed transaction logs. Most funds are kept in cold storage, but Coinbase controls private keys.

Binance: Operates globally with lighter KYC for lower tiers, often used in laundering schemes. They’ve been under investigation by regulators and facilitate over 350 cryptocurrencies, making tracing complex, especially with cross-chain transfers.

Kraken: U.S.-based with solid security and compliance. Known for strict KYC/AML and offering transparency in account verification, useful for tracking down identities. Supports a range of cryptos, including privacy coins like Monero.

Gemini: Heavily regulated in the U.S., with strong KYC/AML protocols. Offers detailed verification logs, making it easier to trace users. Known for security, often favored by institutional investors, with transparent records.

Three Kinds of Coinbase Wallets

In our example we will focus on using Coinbase. Here’s a breakdown of the three types of wallets you'll come across with Coinbase. Each one offers different features and levels of control:

Coinbase Primary Balance: This is what you get on Coinbase.com or the main Coinbase app. The crypto is stored on Coinbase’s servers, and they manage your private keys for you. It’s great for fast trades and lower network fees, but you can’t use it to access decentralized apps (dApps).

Coinbase Wallet: This wallet is self-custodied, meaning you’re in charge of your private keys and seed phrase. It gives you direct access to the blockchain and lets you use dApps. However, the responsibility for securing your assets is on you. Plus, it supports more tokens, even those not listed on Coinbase.com.

Web3 Wallet: This option is a mix of self-custody and convenience. Coinbase holds half of your private key, and your device holds the other half. It’s built for easy access to dApps and decentralized exchanges (DEXs) and supports Ethereum, Polygon, and Base. You can also trade tokens not available in your main Coinbase account.

Two Apps: Coinbase App and Coinbase Wallet App

Your primary balance in the Coinbase App is not viewable on a blockchain explorer because it’s held in a centralized exchange. Coinbase manages your assets off-chain, meaning they aggregate user funds in large institutional wallets. While your personal balance is visible in your Coinbase account, it’s not directly linked to an individual blockchain address you can search for.

In contrast, assets stored in the Coinbase Wallet App are viewable on a blockchain explorer. Since the Coinbase Wallet is decentralized, every transaction or balance associated with your wallet’s public address can be tracked on-chain. This means anyone with your wallet's public address can look up balances and transaction history through blockchain explorers like Etherscan or Blockchair, depending on the blockchain you're using.

So, while the Coinbase Wallet allows full transparency and access to blockchain data, your primary Coinbase App balance remains off-chain and out of direct view on explorers.

When you're using Coinbase, it's important to understand that there are two separate apps: the Coinbase App and the Coinbase Wallet App. Each serves a different purpose, and depending on what you're trying to do, you’ll likely need both.

The Coinbase App is a centralized exchange platform. It’s where you’ll handle buying, selling, and trading cryptocurrencies. You can link your bank account, deposit funds, and exchange fiat (like USD or EUR) for crypto. Coinbase manages your private keys, which means they store and secure your assets for you. This is where your primary balance is held, making it the easier option for trading and managing your assets without having to worry about the technical details of securing your own funds. However, since Coinbase holds your keys, you rely on their security infrastructure.

On the other hand, the Coinbase Wallet App is entirely decentralized. Here, you are in control of your private keys, meaning you manage the security of your crypto yourself. This wallet is not just for holding crypto—it’s your gateway to the decentralized world. You can use it to interact with decentralized apps (DApps), store NFTs, and access a variety of blockchain-based services. The big difference is control: if you lose your private keys in the Coinbase Wallet, there’s no recovery. You have full responsibility, but with that comes full ownership.

In summary, the Coinbase App is ideal for managing your primary Coinbase balance and making straightforward trades in a secure, centralized environment. Coinbase Wallet is for more advanced use, like self-custody of assets and interacting with the decentralized ecosystem. You’ll need both if you want access to all the features Coinbase offers, but each serves a specific role in managing and securing your crypto.

How They Send and Receive Crypto

If we’re investigating someone who’s using the Coinbase app to send and receive crypto, here’s how the process usually works:

To send crypto, the individual would start by opening the Coinbase app and selecting the ‘Send’ option. They’d choose the cryptocurrency they want to send from their balance, like Bitcoin or Ethereum, and then input the recipient’s wallet address. That wallet address is a critical piece for us because it’s unique to the transaction and can be tracked on the blockchain. Once the amount is entered, they would confirm the transaction, paying any network fees along the way. This is where blockchain explorers come in handy for investigators, as we can follow the flow of funds from this point onward. Every transaction is recorded, so once that crypto is sent, we can trace its path.

When it comes to receiving crypto, the process is just as transparent. The individual would generate a wallet address in the Coinbase app and share it with the sender. From our standpoint, that wallet address becomes a key identifier, as we can trace any incoming funds to see where they came from. The moment the crypto is sent to their wallet, it’s recorded on the blockchain, and we can use this information to build a profile of their activity—whether it’s small transfers between personal accounts or larger transactions that could indicate illicit behavior. By looking at patterns in sending and receiving, we can start to map out connections between addresses, platforms, and individuals.

Blockchain Explorers

As an investigator you will be viewing this activity through a blockchain explorer website. Blockchain explorers are tools that let you look directly into the blockchain to see detailed information about transactions, addresses, and blocks. They give you a clear view of what's happening on the network, like where funds are going and who’s sending or receiving them. Think of them like search engines, but instead of finding websites, you’re tracking the movement of cryptocurrency and viewing transaction histories. With explorers, you can follow the flow of funds, check wallet balances, and even track confirmations for any given transaction.

Some examples of blockchain explorers include BTCScan.org, which is focused on the Bitcoin network, Blockchain.com, which is one of the most well-known and widely used explorers, and Blockchair.com, which supports multiple blockchains and offers advanced search features. These platforms allow you to search for transactions using a wallet address or transaction ID and can be incredibly useful for both beginners and experienced investigators looking to dive deeper into blockchain data.

Transaction - BTC Transaction (March 6, 2023)

Short Background

Before getting started, here is a quick review of the three types of wallets offered by Coinbase.

Coinbase Primary Balance: This is what you get on Coinbase.com or the main Coinbase app (named Coinbase App). The crypto is stored on Coinbase’s servers, and they manage your private keys for you.

Coinbase Wallet: This wallet is self-custodied, meaning you’re in charge of your private keys and seed phrase. It gives you direct access to the blockchain. For this wallet, you need to get a different app, the Coinbase Wallet App. (So just to clarify, there is one app called the Coinbase App and another called the Coinbase Wallet App.)

Web3 Wallet: This option is a mix of self-custody and convenience. Coinbase holds half of your private key, and your device holds the other half. It’s built for easy access to dApps and decentralized exchanges (DEXs) and supports Ethereum, Polygon, and Base.

Also, recall from the background section that the CBP in the Coinbase App is not viewable on a blockchain explorer because it’s held in a centralized exchange. Coinbase manages the user’s assets off-chain, meaning they aggregate user funds in large institutional wallets. So while my personal balance is visible to me in my Coinbase account, it’s not directly linked to an individual blockchain address that you could search for.

If you skipped the background chapters at the beginning of this section, you might find the talk of different kinds of wallets and apps a bit confusing. If so, you don’t have to read the full background chapters, but you may want to go back and read the chapters Three Kinds of Coinbase Wallets and Two Apps: Coinbase App and Coinbase Wallet App.

Summary: At this point, we’ve reviewed the types of Coinbase wallets: the Primary Balance (off-chain and managed by Coinbase), the self-custodied Coinbase Wallet (publicly viewable on the blockchain), and the Web3 Wallet (a hybrid solution). Understanding these distinctions is key, as each wallet functions differently when interacting with the blockchain, and this will become important as we dive into the transaction details.

Getting Set Up

Now for the transaction I purchased $7 of Bitcoin BTC from the Coinbase Exchange by using the Coinbase App. The BTC appeared in my Coinbase Primary Balance (CPB). Opening the App shows the primary balance and Web3. In the following screenshot, the user has $1.05 worth of currency in their CPB / “Primary balance”.

In addition to the CPB wallet, I also got a Coinbase Wallet with the address bc1qlwcchp4vjj8ezhglr8k4ef02s8gh5hhghxr3pr (xr3pr).

The Coinbase Wallet is publicly viewable on blockchain explorers. But at this point xr3pr is empty and has no transactions on the blockchain. My BTC at this point is still in my CPB wallet.

Let’s now get to the transaction itself.

Now that we've established the different types of wallets within Coinbase and their unique characteristics, let’s dive into a real-world example. Below, we'll examine a Bitcoin transaction, exploring it from both the sender's and recipient's perspectives using the Coinbase Apps, and then analyzing it through the lens of a blockchain investigator using a blockchain explorer

Transaction - Coinbase Apps Perspective

In this transaction I send 0.00019779 BTC (worth $10 at that time) from a CPB to the Coinbase Wallet xr3pr. I own both wallets in this case so we can see both sides of the transaction.

Sender

Let’s look at the Coinbase App through a mobile phone. As the sender, transferring crypto from my CPB to another wallet, I see the following “sent” screenshot.

The “sent” screenshot shows that I sent the funds on the Bitcoin “Network” (that will be relevant later on in this section). We also see the transaction fee from the network along with the wallet address receiving the funds.

The transaction ID (referred to as the transaction hash) is listed 4aaeb8418f7ff104566b65dd7a61d8e4de65f6b8fe42bacb066579595cddbe43. Be aware that long strings of characters like hashes and addresses are only partially shown (ex. the transaction hash is displayed as “4aaeb8…ddbe43”). But the full identifier is still available to the user, its just displayed this way to make it easier reading.

Notice that the sender’s screen does not identify a wallet address that sent the funds, it only shows the receiver’s address bc1qlwcchp4vjj8ezhglr8k4ef02s8gh5hhghxr3pr (xr3pr). The CBP wallet does not have a public wallet address identifier. In fact, it is easier to think of it as an account instead of a wallet, but we will continue referring to it as a wallet here.

Summary: From the sender’s perspective, moving funds from a Coinbase Primary Balance to the Coinbase Wallet appears like a simple transaction, but remember, the CPB is managed off-chain by Coinbase. This means it’s not tied to an identifiable wallet address visible on the blockchain. However, once the funds land in the Coinbase Wallet, the transaction becomes publicly viewable.

Recipient

As the receiver of the transaction, I use the Coinbase Wallet App to see the funds sent into my Coinbase Wallet xr3pr. The following screenshot is the “received” screen that is viewed by the Coinbase Wallet owner that received the transfer.

We see that 0.000162 BTC was received. This is the amount sent, minus the transaction fee.

There are three main differences between the sender and receiver screens.

First, the receiver does not see the transaction fee, only the amount received.

Second, unlike the sender, the receiver see an actual wallet address identified as the sender. The sending address is bc1qt4ruwck0umfdmwk39cvk4gemdyth08m5v7jxw3 (7jxw3).

Third, the sender’s screen showed that the funds were sent on March 3rd, 2023. The receiver sees that the funds were received on March 6th, 2023.

Why the disparity?

In this case, the “sent” date and time refers to when the sender submitted the transaction on the Coinbase App. As we will see in a bit, Coinbase did not actually send the funds until three days later.

There is also a 40 minute delay at the end that is due to the time lapsed between when a transaction is broadcast to the network and when the transaction is actually confirmed and recorded on the blockchain.

Transaction - Blockchain Explorer

Now let’s look at the transaction from the perspective of an investigator looking using a blockchain by explorer. Here we are using a typical explorer, Blockchain.com/explorer. Using the explorer I looked up the transaction by searching in the search bar for the transaction’s ID 4aaeb8418f7ff104566b65dd7a61d8e4de65f6b8fe42bacb066579595cddbe43. The resulting page ((https://www.blockchain.com/explorer/transactions/btc/a9f151aaa1588c78c381f3b8590dc111fa78adc270c4c64c04dc932a5d6605dd) is shown in the following screenshot. Don’t worry that it is too small to read.

Let’s jump straight to the most notable factor. Look at the bottom of the screen you see the sender and receiver wallet addresses identified and the amounts that were sent or received.

Previously we saw that the sender and receiver viewed a simple transfer of 0.000162 BTC from one party to another.

But in the blockchain explorer we see that there is one wallet address (7jxw3) sending a full 10.000000 BTC to 58 separate wallets.

And if we scroll all the way down the list of recipients we see our Coinbase Wallet (xr3pr) receiving approximately 0.000162 BTC.

Before getting into this further, let’s look at what other information is available on the explorer’s transaction page. There is a summary section on the top right.

It says the transaction was “Broadcasted on” March 6, 2023, at 5:47 AM (GMT-5). This actually refers to the date and time when the transaction was confirmed and added to the blockchain, it is not referring to the moment when the transaction was initially broadcasted to the network by the sender.

Amount: 9.99940934 BTC, valued at approximately $576,885 (this is the amount after the transaction fee)

Fee: 59,066 SATS, around $34.08

To: 58 outputs

From: bc1qt-7jxw3

The summary section at the top of the page says that "This transaction was first broadcasted on the Bitcoin network on March 06, 2023 at 05:03 AM GMT-5." So we know it took 40 minutes from the moment of broadcast to the confirmation. That is not terribly important at this point but good to know in general how to check it.

There is also an Advanced Details section that specifies the input value (10 BTC) and output value (9.99940934 BTC) among other details

Summary: On a blockchain explorer, we see much more complexity than what’s shown in the Coinbase Apps. The transaction isn't just a direct transfer between two wallets—it’s part of a larger movement of 10 BTC split across 58 wallets, highlighting how exchanges like Coinbase aggregate and manage multiple transfers in a single transaction.

What is happening here?

As noted, Coinbase manages the user’s assets (in this case my CBP balance) off-chain, which means that Coinbase aggregates user funds in large institutional wallets. So the sending wallet address (7jxw3) is one of Coinbase’s large institutional wallets. Coinbase combines multiple transfers into one transaction for the sake of streamlining operations and lowering transaction fees.

The sender address does not otherwise represent my CBP or its actions.

We can look up the sender address (7jxw3), which brings us to (https://www.blockchain.com/explorer/addresses/btc/bc1qt4ruwck0umfdmwk39cvk4gemdyth08m5v7jxw3)

We see that the wallet is currently empty with a Bitcoin Balance of 0.0.

We could also obtain the QR code for the address if we clicked on the orange square next to the Bitcoin Address. The QR code can be scanned or searched using a reverse image search on Google or other search engine’s image search options. This is just one more way to try to find information about an address on the Internet.

The wallet’s activity is summarized. Simply put, it has only been used in two transactions. The wallet received 10 BTC in one transaction, and sent 10 BTC in another. This is the classic behavior of an exchange’s institutional wallet.

In the transactions section of the page, we see the two transactions. One transaction (at the top) is the one we were viewing previously.

In the other transaction, the wallet (7jxw3) is the recipient, receiving funds from the address bc1qm3mukxjkc2yl65s5wwgxmmkk4ap8tqqyvslafe (vslafe).

This transaction occurred first, 23 seconds before the transaction we were examining.

In this first transaction the wallet (7jxw3) receives 10 BTC, the same 10 BTC that it dispersed seconds later to 58 wallets including mine.

As an investigator, I strongly recommend that you do not investigate (vslafe). That is a dangerous rabbit hole that very likely leads to nowhere except frustration. Ultimately, it does not matter where the funds came from in this instance. What’s relevant here is that while I purchased the BTC in February, the wallet that actually sent the BTC on my behalf had only obtained the funds 23 seconds beforehand. This highlights that the actions of my CPB within the exchange are not reflected on the blockchain.

Summary: This transaction exemplifies a common scenario for investigators: the funds move through an institutional wallet (like Coinbase’s) where multiple transactions are bundled together. Even though the wallet doesn’t directly reflect the actions of individual users, the overall structure of the transaction provides clues about its origin and the entities involved.

Wrapping it up

This type of transaction is common and one you're likely to encounter in investigations. The key takeaway is that while it’s tempting to assume a direct link between the sender and recipient—or even among the recipients themselves—that assumption may not always hold true, especially with transactions managed by centralized exchanges like Coinbase.

If you were investigating my Coinbase Wallet (xr3pr) without knowing the backstory, you’d see it received 0.000162 BTC from (7jxw3), just one of many recipients in a 10 BTC transaction. However, (xr3pr) has no connection to the other 57 wallets or to the sending wallet (7jxw3) aside from this transaction.

The public information available through blockchain explorers and search engines won't reveal that (7jxw3) is tied to Coinbase, but the size and structure of the transaction suggest it’s likely associated with a large entity like an exchange.

To make this assessment, you can rely on two key factors: the large amount of funds (a round 10.000000 BTC) sent to multiple recipients, and the fact that the sending address has only two transactions—one receiving and one sending.

While this doesn’t directly solve a case or identify specific owners, it gives you valuable insight into the transaction’s nature, helping you understand the context and complexities behind what’s visible on the blockchain.

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

Introduction to Cryptocurrency Investigation

June 25, 2025 2:00 pm EST

This webinar will equip participants with the foundational skills to investigate Bitcoin and other cryptocurrencies, trace funds, and uncover crimes. By the end of the session, participants will be able to investigate addresses, trace fund flows, identify red flags, and interpret NFT behavior to support investigative or analytical work.

Hg’s expert trainer provides in-depth training on how look up and identify basic wallet data, understand blockchain transactions, recognize scams, detect suspicious online behavior and visualize transaction networks.

Register Now

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

The following article was published in Pursuit Magazine, a periodical for educating private investigators.

https://pursuitmag.com/unmasking-the-harasser-how-modern-investigation-tools-crack-the-code-on-burner-phones/

Burner phones were once a shield for anonymity. Today, they’re just another thread we can pull to unravel a hidden identity.

Private investigation has always been about keen observation, deductive reasoning, and following the breadcrumbs left by folks who think they’re clever enough to evade detection. In today’s world, however, the power of technology and data can uncover hidden trails that would have been impossible to chase just a few years ago.

Recently, I was involved in a case that highlighted how powerful modern marketing data tools can be when cross-referenced with other information. The case involved a man harassing a client using a burner phone — a device typically considered difficult to trace. But despite his attempts at anonymity, we were able to crack his disguise and unravel his entire life story.

The Client

A client approached me, distressed after receiving several anonymous calls and messages from a number she couldn’t trace. The calls weren’t just bothersome; they were threatening. The client suspected it was a man she had encountered in the past, but without solid proof, it was difficult to proceed with legal action. The harasser was using a burner phone, which usually means they’re trying to stay off the radar.

Traditionally, tracking someone through a burner phone would be a longshot. But with the advancement of data tools, I knew we stood a solid chance to crack this case.

The Phone

I began by entering the burner phone number into a people search website. (There are several powerful databases — TruePeopleSearch.com or FastPeopleSearch.com — that aggregate and cross-reference marketing and public data.) To my surprise, the tool linked the burner number to another number, suggesting it had been associated with the harasser’s primary phone at some point. This connection was the first crack in his wall of anonymity. From that single link, I was able to dig deeper into other sources of data.

Once I had the primary phone number, a flood of information opened up. These websites can pull up linked data that reveals not just names and addresses, but an individual’s entire address history. From the harasser’s real phone number, I accessed information that showed every location he had lived at in the past decade. The depth of the information was astonishing, complete with the names and phone numbers of every person who had shared those addresses with him during that time.

The Data

What was even more revealing was cross-referencing his address history with other individuals. From the data, I was able to track down his parents, siblings, and even some extended family members. I uncovered their addresses, phone numbers, and other personal information such as dates of birth and even social media profiles. These tools paint a shockingly clear picture of someone’s personal life, which made it easy to begin understanding the broader network around the harasser.

One particularly interesting discovery was that the man had recently changed jobs, but the data still carried his old employment information. With a few more cross-references, I was able to determine where he currently worked. This was crucial because contacting his employer was one of the steps we could take to bring the harassment to a stop. At this point, I had built an extensive dossier on the man, going far beyond just identifying him. I had a clear map of his entire personal and professional life, all from what began as a burner phone number.

The Solution

In this case, the power of data was enough to confront the man directly with his real identity, but we chose a more indirect approach. While the idea of contacting his family or employer directly was tempting, it often isn’t the best course of action. As a professional, I don’t recommend clients take matters into their own hands by reaching out to a harasser’s family or workplace, especially in cases where a person could retaliate or escalate.

Instead, I advised the client to work with legal authorities using the information we had gathered. By presenting the evidence we collected, including the detailed tracking of his identity, address history, and family connections, we were able to build a strong case. Authorities contacted the harasser with a clear message that they knew exactly who he was and that his actions would have serious consequences if they continued. In this case, the pressure was enough to stop the harassment without further escalation.

The Tools

This case isn’t unique. Several colleagues of mine have used the same investigative techniques in a variety of cases, from stalking to fraud investigations. The real takeaway here is how much the landscape of private investigation has changed with the advent of cross-referenced data. What would have been an impossible task a decade ago — tracing a burner phone to an individual — can now be done in a matter of hours with the right tools.

One of the most fascinating aspects of using people search websites in investigations is how seamlessly they connect the dots among phone numbers, addresses, and personal details. A phone number is often linked to an address or a name, along with an age. These tools allow you to see when a phone number was associated with an address, which helps in creating a timeline. If the suspect switched numbers, you can still track the person as long as their name or address shows up. Clicking through these connections, you can trace not only where a person lived but also the people they lived with, often mapping out their entire life — including their siblings’ movements, family ties, and work history. In many cases, even a basic Google search of a name, age, and location can reveal even more, such as a LinkedIn profile or other public information, further filling in the blanks of the investigation.

The Takeaway

As private investigators, we must always balance the power of these tools with ethical considerations. It’s tempting to push the boundaries of what can be done with such comprehensive data, but we need to ensure that it’s used in a responsible and professional manner. In this case, data revealed everything we needed to build a case against the man, but stopping the harassment in a lawful, controlled way was the best outcome for everyone involved.

Ultimately, modern data tools have become an invaluable asset in private investigations. While burner phones were once a shield for anonymity, today they are just another thread that can be pulled to unravel an individual’s hidden identity. And as the technology continues to evolve, so too will our ability to protect clients and bring those who harass them to justice.

Learn Crypto Investigation at my upcoming webinar!

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

Introduction to Cryptocurrency Investigation

June 25, 2025 2:00 pm EST

This webinar will equip participants with the foundational skills to investigate Bitcoin and other cryptocurrencies, trace funds, and uncover crimes. By the end of the session, participants will be able to investigate addresses, trace fund flows, identify red flags, and interpret NFT behavior to support investigative or analytical work.

Hg’s expert trainer provides in-depth training on how look up and identify basic wallet data, understand blockchain transactions, recognize scams, detect suspicious online behavior and visualize transaction networks.

Register Now

https://osintacademy.com/cryptocurrency-investigations-webinar-june-2025279898

Tracing In-World Activity and Assets

Once you’ve identified the person’s metaverse account or wallet, you can start uncovering what they’ve been up to. Different types of data are publicly available depending on the platform:

• Virtual Land Ownership: In blockchain-based worlds, land ownership is transparent. Decentraland and The Sandbox both have public maps and blockchain records of land. You can go to Decentraland’s official map (called Genesis City map) or The Sandbox’s map and click on parcels to see the owner’s wallet address or nickname. If you prefer blockchain data, each LAND token is an NFT that contains metadata of coordinates and the owner’s address . For example, using Etherscan on the Decentraland LAND contract, you can query which address owns a particular parcel ID, or list all tokens owned by the person’s address. Decentraland’s LAND Manager or marketplace will show all parcels a given address owns when you connect that address. In The Sandbox, the website’s profile for a user (if they log in with a wallet) might list owned lands and assets. Alternatively, on OpenSea you can view “The Sandbox LAND” collection filtered by owner address. Virtual real estate transactions are also public – if the person bought or sold land, you can see transaction dates and prices on the blockchain or in marketplace transaction history (OpenSea shows past sale events for NFTs).

• Avatar Customizations and NFTs: Many metaverses use NFT items for avatar wearables, accessories, or even avatar itself. In Decentraland, wearables (clothes, hats, etc.) are NFTs minted on Ethereum or Polygon (Decentraland moved wearables to Polygon for lower fees). You can see which wearables the person’s wallet owns – these might show up in their OpenSea collection or on the Decentraland marketplace under their address. This can tell you how they dress their avatar or which limited-edition items they obtained. For instance, if you see they own a “MetaZoo Shirt (Rare)” wearable NFT, you know they either bought it or were perhaps involved in an event where it was given out. In non-blockchain platforms like Roblox, avatar items aren’t NFTs on a public chain, but you can often view a user’s inventory of collectibles. Roblox profiles have a section for the user’s “Inventory” (if not hidden by privacy settings) where you might see what badges, accessories, or game trophies they have. You might discover they earned a badge for attending a Roblox event, or they have rare limited items (Roblox limiteds are items that can be resold and are tracked publicly). Third-party sites like Rolimon’s track Roblox limited item ownership – by searching the username there, you can see which limiteds they own and their market values.

• Event Attendance: How can we tell if someone attended a virtual event? In some cases, event participation leaves traces:
  

  • In blockchain metaverses, a popular method is POAP – Proof of Attendance Protocol tokens. POAPs are a type of NFT that allows people to prove they attended digital or in-person events . Many Decentraland events (concerts, festivals, conferences) distribute POAP badges to attendees (these are free NFTs, often minted on a sidechain like Gnosis Chain). If the person’s wallet has POAP NFTs, each token usually has the event name and date in its metadata. For example, if you see a “DAO Voting Party 2024 POAP” in their wallet, they were at that event. You can use a site like poap.xyz or poap.gallery to look up an address or ENS name and see all associated POAPs, which effectively gives you a timeline of events they joined. This is a very powerful way to trace someone’s engagement in community gatherings, virtual conferences, or launch parties in the metaverse. It’s like seeing their collection of ticket stubs – and it’s public.

  • In non-blockchain platforms, event tracking is less straightforward because there isn’t an equivalent of a POAP in most cases. However, some games give badges or achievements for attending events. For instance, Roblox might give a badge if you participated in the Lil Nas X Concert experience or a special Roblox developer conference world. These badges show up on the user’s profile under “badges” and are visible to others. So check their profile for any event badges. Additionally, you might rely on social clues: people often tweet screenshots from events or join specific event-related groups which remain on their profile.

  • Another indirect method: search for the person’s username in context of the event. E.g., if you know they might have gone to “Metaverse Fashion Week”, search “AliceWonderland Metaverse Fashion Week Decentraland” – you might find a list of attendees or a recap where they’re mentioned. Sometimes event organizers publish lists of winners or notable attendees (especially if your target person is a known figure, they could be mentioned in a blog).

• Marketplace Activity and Commerce: If the person buys or sells virtual goods, there can be trails:
  

  • On blockchain marketplaces, every sale or purchase is a transaction you can see. If their wallet bought a wearable NFT or sold one, you can find that on Etherscan or the marketplace’s transaction history (OpenSea, Decentraland marketplace, etc., often list recent sales). You might see they paid X MANA for a jacket wearable on a certain date. This tells you not just what they own, but also their trading activity and maybe how much they’re investing.

  • If they create content for sale (like designing an NFT wearable or building and selling a custom VRChat avatar), look for evidence of that. Decentraland creators are listed on the wearable NFT metadata (it will say “Creator: [address]”). If you see the person’s address as a creator of items, they’re not just participating but contributing content. In The Sandbox, if they made a custom asset (say a 3D model NFT), the Sandbox marketplace or OpenSea would list their address as creator. On Roblox, check if they have any Creations (Roblox profile has a “Creations” tab showing games they made or assets they published in the marketplace). Their created games might show how many visits they have or if they earn Robux (Roblox’s currency) from them, which indicates commercial activity. On VRChat, see if they authored any worlds (some VRChat world listing websites or the VRChat SDK’s content manager might credit the creator by username).

• Social Connections (Friends and Groups): Understanding whom the person interacts with in the metaverse can also be revealing. Different platforms handle this differently:
  

  • Friends Lists: On some platforms, friends lists are public. For example, by default Roblox shows a user’s friends list and the groups they belong to on their profile to anyone who logs in . If you visit their profile, you can scroll to see “Friends” and “Groups.” This can tell you who they hang out with or what communities they’re part of (perhaps they’re in a Roblox group for a particular game or clan). Note that privacy settings can hide this, but many users don’t change the default. As an investigator, seeing their friends could lead you to other accounts or alternate identities (maybe they have a second account that is friends with the first, or you find a friend’s profile that mentions your target in the description). In Decentraland and Sandbox (blockchain worlds), “friends” aren’t recorded on-chain; friendships are usually just within the platform’s social server and not publicly visible by default. VRChat profiles can show friends but only to the user themselves or those they allow. So, for blockchain metaverses, you typically won’t have a public friends list to inspect.

  • Groups/Guilds: Many metaverse users join groups – e.g., Roblox developer forums, VRChat community groups, Discord servers for Decentraland creators, etc. Publicly, Roblox groups are visible on profiles. If the person is in a group like “Decentraland Builders Guild” or “Roblox Dev Forum Members”, that ties them to certain activities or interests. Similarly, check if they have any affiliation listed (some users mention a crew or guild in their bio).

  • Interactions via Blockchain: A subtle form of social connection in blockchain worlds is looking at transaction partners. If the person’s wallet frequently sends NFTs or currency to another specific wallet, that could be a friend or an alt account. Etherscan can show all transactions – you might notice they repeatedly transfer tokens to another address (perhaps moving assets to a main wallet, or trading with a specific user). While this doesn’t give a name, it provides leads (you could investigate that other wallet to see if it has an ENS name or other identity clues).

By compiling these aspects, you start to build a picture of the person’s metaverse life: what property they own, what events they attend, what items they collect or trade, and who they mingle with. All of this is done with public data – blockchain records, user profiles, and search engines – no hacking or private data needed.

Metaverse to Real-World: Tracing an Avatar or Asset Back to a Person

Now let’s consider the reverse scenario. Suppose you encounter a metaverse identity – maybe you saw an avatar named “CoolCatNFT” hosting a big event in Decentraland, or you found a wallet that owns several pricey virtual lands – and you want to find out who is behind it in real life. The approach uses many of the same tools, just in reverse order:

1. Profile Clues and Self-Disclosure: Check if that virtual identity has any public profile info. Many platforms let users write a bio. For example, a Decentraland user can set up a profile on the Decentraland site (especially if they link via wallet, they might have a profile page showing their avatar and name). In Roblox, the profile might have a custom “About” blurb written by the user. Look there for clues like “Follow me on Twitter: @somehandle” or “Managed by [StudioName]”. Roblox even allows linking social networks on profiles (users can link their Twitter or YouTube – icons will appear on their profile linking to those sites). If you see those, that directly bridges to a real-world social account. Similarly in VRChat, while profiles are mostly just status, some users mention their Twitch stream or other contact info in their VRChat bio. Always inspect the profile page carefully for any external links or identifying info.

2. Username Cross-Search: Take that metaverse username and search it on the wider web (the opposite of what we did in person-to-metaverse). People often reuse usernames. Perhaps the host “CoolCatNFT” also uses that handle on Twitter or has an account on NFT forums. A Google search might lead to a GitHub by that name or a LinkedIn username mention. If the username is an email ID (not uncommon in older games), you might search that in breach data search engines (though that goes beyond “free public tools” into gray areas, so stick to open web results). The key is to find any instance where the pseudonym intersects with a real name or an account that has personal info.

3. Reverse WHOIS on ENS or Domains: If the metaverse identity is tied to an ENS name (say the avatar was literally named CoolCatNFT.eth in-world), then check the ENS records. ENS domains can have text records set by the owner – sometimes including an email, URL, or Twitter handle. You can use the ENS lookup tool (app.ens.domains or Etherscan’s “Lookup ENS” function) to see if that domain has public records. Even if not, having the ENS is a clue – maybe they use that as their brand. Searching that ENS name might show that they’ve used it as a username elsewhere (e.g., maybe they commented on a blog and left that as their website, or they have a personal website at coolcatnft.eth.link).

4. Investigate Their NFTs and Wallet Behavior: On the blockchain side, analyze that wallet deeply. Look at the transaction history for any identifiable patterns:
   

   • Did they interact with a known exchange (sending funds to Coinbase or Binance, which are labeled wallets)? If so, they might have off-ramped money there, but you typically can’t get their identity from that alone (that information is private to the exchange). However, if an address is known (say Etherscan labels an address as “OpenSea: User 12345” or “ENS: coolcatnft.eth”), that’s at least a nickname.

   • Look at other NFTs they own beyond the metaverse. People often collect NFTs across various projects. Perhaps they own an NFT from a collection that is linked to a Discord community, and in that Discord the person might have claimed ownership publicly. For example, if they own a Bored Ape Yacht Club NFT, they might be in BAYC communities where they revealed which ape they own. Cross-reference such info if available.

   • See if the wallet has sent NFTs to any known names. Sometimes people send an NFT to their own other address or to a friend. If one of those addresses has an ENS like “AliceWonderland.eth”, you suddenly have a name to chase. Or they might have donated Ethereum to a public fundraiser (some fundraisers post a list of contributors’ addresses or ENS names).

6. Metaverse Activity Context: Consider what the person did in-world that made you notice them. Were they hosting an event? If yes, event pages might list organizers. Decentraland’s event listings often show the host’s name (which could be a wallet or an avatar name). That host name might correspond to a known community member – perhaps the event announcement on Twitter or Discord mentions “Hosted by [real name or organization]”. Similarly, if you find a user’s virtual property (like a famous art gallery in Somnium Space or a popular game in Roblox created by a certain user), research that property. Many creators promote their work on external channels. A Roblox game developer might have a DevForum post or Gamasutra article about their game, where they use their real name. A Decentraland builder of a museum might have a website for it, crediting themselves. Follow the content.

7. OSINT on Connected Accounts: If you do find a clue linking the metaverse identity to a likely real-world account (say you suspect a Twitter account belongs to them), apply standard OSINT to that account. For example, if you find a Twitter handle, see what email or website is listed on it, check if that Twitter handle has used the same avatar picture as seen in the metaverse, etc. Oftentimes, people use the same avatar image on Twitter as their in-game avatar – a dead giveaway! They might also talk about their virtual activities in first person, confirming the link.

Through these methods, you aim to connect the dots from an in-game persona to a real person or at least a social media profile. Always ensure you’re using ethically-gathered, public information. If a person has taken steps to remain pseudonymous, it might be difficult or impossible to be 100% sure about their real identity without private data. But you can often narrow down possibilities or find their other pseudonyms.

What Metaverse Data is Public?

It’s important to understand which data in metaverse platforms is publicly accessible by design. Here’s a rundown of common data types and their availability:

• Blockchain Assets (Public by design): In Web3 metaverses like Decentraland and The Sandbox, key assets (land, avatars names, wearables, currency) are blockchain tokens. By design, ownership is recorded on the blockchain for anyone to see . This means what someone owns is public (including when they acquired or transferred it). Land ownership is basically a matter of public record (anyone can check the Ethereum ledger and see which address owns which land token). Avatar names (Decentraland NAMEs) are NFTs, so those too are public. Transaction history (buying/selling/gifting an item) is public on-chain . This is a stark difference from traditional games: if you buy a sword in a typical game, only the game company’s database knows; but if you buy a sword NFT for a blockchain game, everyone can see that transaction. So, blockchain metaverses provide a wealth of OSINT-friendly data – you just need the wallet address or NFT ID.

• Profile Information (Platform-specific): Most platforms have user profiles that show some info to others:
  

  • Roblox: Very public. Username, avatar image, friends (unless hidden), groups, the date joined, last online (this was visible in the past; currently Roblox hides last online to non-friends, as a privacy measure), the “about” bio, and a list of the user’s creations and inventory items (if not set to private). The fact that anyone with an account can view another user’s friends list and groups by default means a lot of social data is exposed. (Roblox has been discussing adding privacy options for these).

  • Decentraland: If you have the wallet or name, you can see their avatar’s appearance (by observing in-world or using the profile preview on the website). Decentraland’s web profile (if the user has logged in on the website) might show their collectibles or linked wallet. However, Decentraland doesn’t automatically show “friends” publicly. It does show if an avatar is currently online and which instance (realm) they’re in, but only to friends in-world. There is no global directory of who is online. So profile info is minimal: essentially their name, maybe a bio if they added one on a linked dcl profile, and their wardrobe (only observable if you see them in-world).

  • The Sandbox: Users mostly interact via their wallet accounts. The Sandbox website could display a profile (for example, if they created assets or Game Maker experiences, those might be tied to a username). But a lot of info is still the NFTs they hold. The Sandbox does have leaderboards for certain events, which might list top players by username.

  • Spatial: Spatial’s user profiles can show galleries they created and possibly an avatar image. Spatial often involves showing artwork or NFT galleries, and users might link their profiles to their crypto wallet or email. If a Spatial gallery is public, the owner’s username is shown and you might find links they share.

  • VRChat: Profiles are semi-private. By default, you can search for a user by exact name if you’re logged in, and you’ll see their profile which may include status, avatar thumbnail, and maybe tags (like “Trusted User” level etc.), but not much else. Friends are private, and there’s no built-in bio field to list external info (some put info in their status or avatar description though). VRChat does not expose user activity publicly (you can’t see what worlds someone has visited historically, for example). However, VRChat users who create worlds or avatars leave traces: each world has an author (username) visible to anyone visiting that world’s info page. So if the person made a world, their username is on it, and sometimes they include a link to their Twitter or Discord on the world’s description.

• Public Communications: Chat logs in these platforms are generally not public. If someone had a conversation in-game, that stays in-game (unless someone screenshots it). Forums and Discords, however, are public realms where metaverse users discuss things. For example, Decentraland has a public forum (governance forum) where proposals and grants are discussed – users post with their wallet accounts (which might display as their ENS or name). That means if the person participated in governance, you could find posts by their address or name on the forum, revealing opinions or initiatives they have. Similarly, many platform communities have Reddit subforums (e.g., r/VRChat, r/Roblox) where users ask questions or share content – you might stumble on the person asking a question like “How do I sell my land?” which links their Reddit account to that interest.

• Metaverse Commerce Data: Beyond assets, consider that some metaverses have their own transaction ledgers. For instance, Second Life (an older virtual world) had an internal currency and you could look at someone’s store or their seller rating, etc., via the marketplace site. In newer metaverses, most commerce is tied to NFTs or in-app purchases. If a platform isn’t blockchain-based, any purchase they make (like buying Robux or in-app currency) is not public. But any item they own as a result may be visible on their profile (like a game pass or badge).

• Linking Identities: A lot of users voluntarily link their metaverse identity to other identities. For example, Decentraland NAMEs are part of ENS . If someone named their avatar “Alice”, they effectively might own alice.dcl.eth (the underlying ENS for Decentraland names). ENS is often linked to Twitter via services like verified ENS Twitter names (some people verify their ENS on their Twitter profile using third-party services so that sites like Etherscan can show a Twitter handle for an address). Also, Roblox’s profile social links feature explicitly connects to Twitter/YouTube as verified links (icon-based), which is an intentional identity bridge. Always check if the platform profile has fields for Facebook, Twitter, Twitch, YouTube etc. Many gaming platforms do (Roblox, Fortnite’s Epic Games account, etc.). If those are filled out, they are goldmines for connecting to a real person or at least a broader online presence.

Platform Comparisons: Blockchain vs. Non-Blockchain Worlds

Different metaverse platforms require different investigative techniques. The major dividing line is whether the platform is blockchain-based (decentralized) or centralized. Let’s compare how some popular platforms differ:

• Blockchain-Based Metaverses (Decentraland, The Sandbox, Cryptovoxels/Voxels, Somnium Space, Others): These worlds use cryptocurrency wallets for user login and asset ownership. As a result, the user is essentially an address on the blockchain, and all their in-world possessions (land, items, name) are on-chain assets. For investigation, this means you rely heavily on blockchain explorers and NFT marketplaces to trace activity. Once you have their wallet, you can see everything they own or have owned on that platform. For example, in Decentraland, if you know Alice’s wallet, you can instantly pull up all the LAND tokens and wearable NFTs that wallet holds, because “users truly own their digital assets… with ownership registered on the blockchain” . You can also see every transaction (like transfers of MANA, purchases of items) – nothing is hidden behind the company’s database. The challenge here is connecting the wallet to the human: wallets are pseudonymous by default. But if the person ever linked it to an ENS name or used it on a social platform, you can make that connection. Investigative tools for blockchain worlds often include Etherscan (for Ethereum-based assets), Polygon’s explorer (Decentraland uses Polygon for some assets), Dune Analytics (which has community-made dashboards, e.g., a Dune dashboard might show “Top Land Owners in Sandbox” or “Activity of Decentraland Names”), and NFT aggregators. You typically do not have a built-in notion of “friends list” or chat history to examine, because those social features happen off-chain (e.g., Decentraland chat goes through their servers and is not logged publicly). So you lean on asset and transaction data and whatever the user voluntarily shares externally.

• Centralized Metaverses (Roblox, VRChat, Fortnite Creative, Rec Room, etc.): These platforms have traditional account systems (email/username login) and store data internally. Public data is what the platform chooses to expose in profiles or via APIs. Roblox is notably open in some respects: user profiles list creations and collectibles, and Roblox has APIs that return data like a user’s friends, the games they’ve visited recently (if you have an API key or use certain endpoints), etc. There are also fan-made databases of Roblox user stats. VRChat is more closed – no public friend lists or play history. However, VRChat’s API (if one reverse-engineers it) can tell if a user is online and in which world, if you have their API key and account auth (this is more advanced and not in the realm of “public” since it requires login). But VRChat does have public content listings (worlds and avatars that creators choose to share in public portals). Investigating a VRChat user often means looking at where they hang out (maybe they always join a certain DJ night – you find their name on an event flyer) or if they create content. Spatial and similar newer platforms often blend aspects: you can log in with an email or with a crypto wallet depending on user choice. If they logged in with a wallet, you can then do blockchain OSINT; if with email, you rely on what they showcase on their profile.
  One important note: centralized platforms sometimes have developer forums or user communities where people use the same username. For instance, Roblox has the DevForum where developers discuss and often their DevForum username is the same as their Roblox username (and sometimes they sign posts with their real name or link their portfolio). VRChat has a community forum and many users there might reveal more about themselves. Including these in your search can help bridge identities (e.g., a Roblox user might have a DevForum thread where they announce a game and provide a Discord link or personal website).

• Privacy Differences: Generally, blockchain metaverses are more transparent about assets, while traditional platforms are more transparent about social connections. In a blockchain world, I can easily see what you own but not who you talk to. In Roblox/VRChat, I can often see who your friends are or what group you’re in, but not the details of your inventory unless it’s made public. Each platform also has its terms of service and privacy rules, so keep in mind that just because you can see something publicly doesn’t mean the user realizes it’s public. Always use information responsibly.

To illustrate, consider an example comparison: If Alice has a foot in both Decentraland and Roblox, an investigator can see her Decentraland wallet bought two land parcels and a rare hat (since those are on Ethereum), and also see that her Roblox account (say, “Alice_Wonder”) is in the “VR Enthusiasts” group and has 50 friends visible, one of whom is likely her alternate account (maybe named AliceDev). The investigator would use blockchain tools for the former and the Roblox website or API for the latter. Both streams of information together provide a fuller profile of Alice’s virtual life.

Tips, Tools, and Resources (Free) for Metaverse Investigations

Finally, let’s compile a list of free tools and resources that can aid your metaverse sleuthing. These tools require no paid subscriptions:

• Search Engines & Operators: Google, Bing, DuckDuckGo – use keywords, quotes for exact username searches, and platform-specific operators (site:roblox.com, site:decentraland.org, etc. to narrow results). Don’t underestimate simple searches.

• Blockchain Explorers:
  

  • Etherscan (for Ethereum) and Polygonscan (for Polygon) – indispensable for looking up wallet addresses, token holdings, ENS names, and transaction history. You can input an address and see all ERC-20 tokens (like MANA, SAND) and ERC-721/1155 NFTs it holds, along with past transactions. Look at the “Analytics” tab on Etherscan for any unusual spikes in activity.

  • Blockchair or Solscan – if you need to search other chains (Blockchair can search across multiple blockchains for an address or transaction).

  • ENS Lookup: Use Etherscan or the official ENS App to find info about an ENS domain (owner address, and any text records it might have).

• NFT Marketplaces and Aggregators:
  

  • OpenSea – search by wallet address or username. Many users have OpenSea accounts that show their collections. You can also search collections like “Decentraland LAND” or “Decentraland Names” or “Sandbox’s LAND” and then filter for the owner’s address to see which ones they own.

  • LooksRare, X2Y2 – other NFT marketplaces if OpenSea doesn’t show something (but OpenSea is the broadest).

  • RARIBLE – sometimes people list items on Rarible or have a profile there.

  • Nonfungible.com – a site that tracks NFT markets and can sometimes let you look up an address to see what NFTs it has across several collections.

  • Dune Analytics – community-made dashboards (free to use). Search the Dune site for dashboards related to Decentraland or Sandbox; for example, there might be a dashboard listing top landowners or recent sales, which can save you time.

• Metaverse Platform Tools:
  

  • Decentraland Atlas / Marketplace – the official Decentraland marketplace (market.decentraland.org) lets you search for names, view accounts (addresses) and their assets (under the “Account” section if you plug in an address or name). The Atlas view shows land parcels and their owners.

  • The Sandbox Map – on sandbox.game, the interactive map lets you click owned lands to see owner addresses or names (some lands are owned by known partners and show a name). The Sandbox also has a section for user profiles if you know the nickname (some creators have public profiles).

  • Roblox Website & APIs: The Roblox profile page itself is a primary tool (just go to roblox.com and search the username). For deeper info, Roblox has APIs (for example, you can fetch a JSON of a user’s friends by a call to friends.roblox.com/v1/users/[userid]/friends). There are third-party wrappers and tools like RoSearcher (a browser extension to find which game server a user is in) that can be used to see if they are currently playing something. Rolimon’s (rolimons.com) is a fan site listing Roblox inventories (especially limited items) and user value rankings. It’s free to use and great for seeing if someone has rare items.

  • Namechk / Sherlock – as mentioned, for scanning username availability across platforms (this can hint if the person likely reserved their name on multiple sites).

  • Social Media Search: Use Twitter’s search and even advanced search. Many metaverse projects have official hashtags (e.g., #Decentraland, #RobloxDev). If you search the username or wallet address on Twitter, you might find posts like “my wallet 0xABC… got a new NFT” or someone asking for help with something.

  • Discord Communities: Many metaverse communities live on Discord (Decentraland, Sandbox, etc. have official servers). While Discord messages aren’t indexed on search engines, some servers have public channels that are visible or are logged by bot websites. You can also join these servers (free) and use the Discord search within them. Searching for the username or ENS there could show if they said anything or if others mentioned them (like @username).

  • Forums and Q&A: Reddit, StackExchange (there is a StackExchange for Ethereum where sometimes people discuss ENS and such, possibly revealing their addresses), and platform-specific forums (Decentraland Forum, Roblox DevForum, etc.). Use their internal search or Google’s site search to find the alias.

• POAP Tools:
  

  • POAP Scan (poap.scan or the POAP app) – enter an Ethereum address or ENS and see the list of POAPs (event badges) it holds .

  • POAP Gallery – a visual way to see collections of POAPs by address .

  • These help confirm event attendance and sometimes the POAP itself has clues (the artwork or title might reveal what kind of event or which community hosted it).

• OSINT People Search Tools: If you’ve moved from the virtual identity to a real name, tools like BeenVerified, Spokeo, etc., are beyond our scope (and often paid). But you can use free resources like simply Googling the real name with “gamertag” or using LinkedIn to see if they mention metaverse skills. This is more if you already suspect a real person behind the avatar and want to verify. For example, if the username is unique, search it on LinkedIn – some developers put their gamer tag in their profile.

• Wayback Machine (Internet Archive): If you suspect a user profile or marketplace listing was changed or removed, the Internet Archive might have snapshots. For instance, if a Decentraland land was listed for sale and then delisted, a cached page might still show the price or owner at that time.

• On-chain Analysis Tools: If you want to go deeper and the free resources above are not enough, there are advanced (sometimes freemium) tools like Breadcrumbs.app (for visualizing connections between crypto addresses) or OnChain analytics platforms. However, these might be overkill for simple investigations and can have costs. Wherever possible, rely on the free basics first (the blockchain is free to query!).

Example Use of Tools: Let’s say you have a crypto wallet address from a tip that “Alice is into metaverse stuff.” You plug it into Etherscan – you find the address has an ENS name alicewonder.eth and holds 2 Decentraland LAND tokens, 5 wearable NFTs, and some MANA. You use OpenSea to see those LAND tokens – they correspond to parcels (10,10) and (10,11) in Decentraland. You visit the Decentraland Atlas, find those parcels are adjacent and form an estate named “Wonderland Gallery.” You go to Decentraland (even without logging in, you can use a guest login) and visit that location – you see a gallery build with a sign “Wonderland Gallery by Alice (Twitter: @AliceArt)”. Now you have her Twitter handle. You check her Twitter, and indeed she often posts about her Decentraland gallery and also mentions her Roblox game development. You search her Roblox username (which you guess might be “AliceWonder” from her Twitter bio) on Roblox.com and find a matching account with several games published. This cascade of discoveries was done with simple tools: Etherscan, OpenSea, the Decentraland client, and web searches – all free and open.

In summary, investigating a person’s metaverse activity involves a mix of blockchain sleuthing and traditional OSINT techniques. By following asset trails on public ledgers, scouring user profiles on gaming platforms, and connecting the dots through social media, you can often build a comprehensive picture of someone’s virtual world footprint. Always remember to respect privacy and use this knowledge responsibly – everything we’ve discussed is about using publicly available information, which the person themselves has either deliberately shared or is inherent to how these platforms operate. Happy exploring, and may your searches unveil the virtual footprints you’re looking for in the ever-expanding metaverse!

Like the blog? Buy the author’s book!

The OSINT Guide - Check it out on Amazon - 4.5 stars!

“Tom Caliendo‘s latest contribution to the field, The Open Source Intelligence Guide stands as a beacon for those looking to delve deeper into the internet’s hidden layers.”

Metaverse to Real-World: Tracing an Avatar or Asset Back to a Person

Now let’s consider the reverse scenario. Suppose you encounter a metaverse identity – maybe you saw an avatar named “CoolCatNFT” hosting a big event in Decentraland, or you found a wallet that owns several pricey virtual lands – and you want to find out who is behind it in real life. The approach uses many of the same tools, just in reverse order:

1. Profile Clues and Self-Disclosure: Check if that virtual identity has any public profile info. Many platforms let users write a bio. For example, a Decentraland user can set up a profile on the Decentraland site (especially if they link via wallet, they might have a profile page showing their avatar and name). In Roblox, the profile might have a custom “About” blurb written by the user. Look there for clues like “Follow me on Twitter: @somehandle” or “Managed by [StudioName]”. Roblox even allows linking social networks on profiles (users can link their Twitter or YouTube – icons will appear on their profile linking to those sites). If you see those, that directly bridges to a real-world social account. Similarly in VRChat, while profiles are mostly just status, some users mention their Twitch stream or other contact info in their VRChat bio. Always inspect the profile page carefully for any external links or identifying info.

2. Username Cross-Search: Take that metaverse username and search it on the wider web (the opposite of what we did in person-to-metaverse). People often reuse usernames. Perhaps the host “CoolCatNFT” also uses that handle on Twitter or has an account on NFT forums. A Google search might lead to a GitHub by that name or a LinkedIn username mention. If the username is an email ID (not uncommon in older games), you might search that in breach data search engines (though that goes beyond “free public tools” into gray areas, so stick to open web results). The key is to find any instance where the pseudonym intersects with a real name or an account that has personal info.

3. Reverse WHOIS on ENS or Domains: If the metaverse identity is tied to an ENS name (say the avatar was literally named CoolCatNFT.eth in-world), then check the ENS records. ENS domains can have text records set by the owner – sometimes including an email, URL, or Twitter handle. You can use the ENS lookup tool (app.ens.domains or Etherscan’s “Lookup ENS” function) to see if that domain has public records. Even if not, having the ENS is a clue – maybe they use that as their brand. Searching that ENS name might show that they’ve used it as a username elsewhere (e.g., maybe they commented on a blog and left that as their website, or they have a personal website at coolcatnft.eth.link).

4. Investigate Their NFTs and Wallet Behavior: On the blockchain side, analyze that wallet deeply. Look at the transaction history for any identifiable patterns:
   

   • Did they interact with a known exchange (sending funds to Coinbase or Binance, which are labeled wallets)? If so, they might have off-ramped money there, but you typically can’t get their identity from that alone (that information is private to the exchange). However, if an address is known (say Etherscan labels an address as “OpenSea: User 12345” or “ENS: coolcatnft.eth”), that’s at least a nickname.

   • Look at other NFTs they own beyond the metaverse. People often collect NFTs across various projects. Perhaps they own an NFT from a collection that is linked to a Discord community, and in that Discord the person might have claimed ownership publicly. For example, if they own a Bored Ape Yacht Club NFT, they might be in BAYC communities where they revealed which ape they own. Cross-reference such info if available.

   • See if the wallet has sent NFTs to any known names. Sometimes people send an NFT to their own other address or to a friend. If one of those addresses has an ENS like “AliceWonderland.eth”, you suddenly have a name to chase. Or they might have donated Ethereum to a public fundraiser (some fundraisers post a list of contributors’ addresses or ENS names).

5. Metaverse Activity Context: Consider what the person did in-world that made you notice them. Were they hosting an event? If yes, event pages might list organizers. Decentraland’s event listings often show the host’s name (which could be a wallet or an avatar name). That host name might correspond to a known community member – perhaps the event announcement on Twitter or Discord mentions “Hosted by [real name or organization]”. Similarly, if you find a user’s virtual property (like a famous art gallery in Somnium Space or a popular game in Roblox created by a certain user), research that property. Many creators promote their work on external channels. A Roblox game developer might have a DevForum post or Gamasutra article about their game, where they use their real name. A Decentraland builder of a museum might have a website for it, crediting themselves. Follow the content.

6. OSINT on Connected Accounts: If you do find a clue linking the metaverse identity to a likely real-world account (say you suspect a Twitter account belongs to them), apply standard OSINT to that account. For example, if you find a Twitter handle, see what email or website is listed on it, check if that Twitter handle has used the same avatar picture as seen in the metaverse, etc. Oftentimes, people use the same avatar image on Twitter as their in-game avatar – a dead giveaway! They might also talk about their virtual activities in first person, confirming the link.

Through these methods, you aim to connect the dots from an in-game persona to a real person or at least a social media profile. Always ensure you’re using ethically-gathered, public information. If a person has taken steps to remain pseudonymous, it might be difficult or impossible to be 100% sure about their real identity without private data. But you can often narrow down possibilities or find their other pseudonyms.

What Metaverse Data is Public?

It’s important to understand which data in metaverse platforms is publicly accessible by design. Here’s a rundown of common data types and their availability:

• Blockchain Assets (Public by design): In Web3 metaverses like Decentraland and The Sandbox, key assets (land, avatars names, wearables, currency) are blockchain tokens. By design, ownership is recorded on the blockchain for anyone to see . This means what someone owns is public (including when they acquired or transferred it). Land ownership is basically a matter of public record (anyone can check the Ethereum ledger and see which address owns which land token). Avatar names (Decentraland NAMEs) are NFTs, so those too are public. Transaction history (buying/selling/gifting an item) is public on-chain . This is a stark difference from traditional games: if you buy a sword in a typical game, only the game company’s database knows; but if you buy a sword NFT for a blockchain game, everyone can see that transaction. So, blockchain metaverses provide a wealth of OSINT-friendly data – you just need the wallet address or NFT ID.

• Profile Information (Platform-specific): Most platforms have user profiles that show some info to others:
  

  • Roblox: Very public. Username, avatar image, friends (unless hidden), groups, the date joined, last online (this was visible in the past; currently Roblox hides last online to non-friends, as a privacy measure), the “about” bio, and a list of the user’s creations and inventory items (if not set to private). The fact that anyone with an account can view another user’s friends list and groups by default means a lot of social data is exposed. (Roblox has been discussing adding privacy options for these).

  • Decentraland: If you have the wallet or name, you can see their avatar’s appearance (by observing in-world or using the profile preview on the website). Decentraland’s web profile (if the user has logged in on the website) might show their collectibles or linked wallet. However, Decentraland doesn’t automatically show “friends” publicly. It does show if an avatar is currently online and which instance (realm) they’re in, but only to friends in-world. There is no global directory of who is online. So profile info is minimal: essentially their name, maybe a bio if they added one on a linked dcl profile, and their wardrobe (only observable if you see them in-world).

  • The Sandbox: Users mostly interact via their wallet accounts. The Sandbox website could display a profile (for example, if they created assets or Game Maker experiences, those might be tied to a username). But a lot of info is still the NFTs they hold. The Sandbox does have leaderboards for certain events, which might list top players by username.

  • Spatial: Spatial’s user profiles can show galleries they created and possibly an avatar image. Spatial often involves showing artwork or NFT galleries, and users might link their profiles to their crypto wallet or email. If a Spatial gallery is public, the owner’s username is shown and you might find links they share.

  • VRChat: Profiles are semi-private. By default, you can search for a user by exact name if you’re logged in, and you’ll see their profile which may include status, avatar thumbnail, and maybe tags (like “Trusted User” level etc.), but not much else. Friends are private, and there’s no built-in bio field to list external info (some put info in their status or avatar description though). VRChat does not expose user activity publicly (you can’t see what worlds someone has visited historically, for example). However, VRChat users who create worlds or avatars leave traces: each world has an author (username) visible to anyone visiting that world’s info page. So if the person made a world, their username is on it, and sometimes they include a link to their Twitter or Discord on the world’s description.

• Public Communications: Chat logs in these platforms are generally not public. If someone had a conversation in-game, that stays in-game (unless someone screenshots it). Forums and Discords, however, are public realms where metaverse users discuss things. For example, Decentraland has a public forum (governance forum) where proposals and grants are discussed – users post with their wallet accounts (which might display as their ENS or name). That means if the person participated in governance, you could find posts by their address or name on the forum, revealing opinions or initiatives they have. Similarly, many platform communities have Reddit subforums (e.g., r/VRChat, r/Roblox) where users ask questions or share content – you might stumble on the person asking a question like “How do I sell my land?” which links their Reddit account to that interest.

• Metaverse Commerce Data: Beyond assets, consider that some metaverses have their own transaction ledgers. For instance, Second Life (an older virtual world) had an internal currency and you could look at someone’s store or their seller rating, etc., via the marketplace site. In newer metaverses, most commerce is tied to NFTs or in-app purchases. If a platform isn’t blockchain-based, any purchase they make (like buying Robux or in-app currency) is not public. But any item they own as a result may be visible on their profile (like a game pass or badge).

• Linking Identities: A lot of users voluntarily link their metaverse identity to other identities. For example, Decentraland NAMEs are part of ENS . If someone named their avatar “Alice”, they effectively might own alice.dcl.eth (the underlying ENS for Decentraland names). ENS is often linked to Twitter via services like verified ENS Twitter names (some people verify their ENS on their Twitter profile using third-party services so that sites like Etherscan can show a Twitter handle for an address). Also, Roblox’s profile social links feature explicitly connects to Twitter/YouTube as verified links (icon-based), which is an intentional identity bridge. Always check if the platform profile has fields for Facebook, Twitter, Twitch, YouTube etc. Many gaming platforms do (Roblox, Fortnite’s Epic Games account, etc.). If those are filled out, they are goldmines for connecting to a real person or at least a broader online presence.

Platform Comparisons: Blockchain vs. Non-Blockchain Worlds

Different metaverse platforms require different investigative techniques. The major dividing line is whether the platform is blockchain-based (decentralized) or centralized. Let’s compare how some popular platforms differ:

• Blockchain-Based Metaverses (Decentraland, The Sandbox, Cryptovoxels/Voxels, Somnium Space, Others): These worlds use cryptocurrency wallets for user login and asset ownership. As a result, the user is essentially an address on the blockchain, and all their in-world possessions (land, items, name) are on-chain assets. For investigation, this means you rely heavily on blockchain explorers and NFT marketplaces to trace activity. Once you have their wallet, you can see everything they own or have owned on that platform. For example, in Decentraland, if you know Alice’s wallet, you can instantly pull up all the LAND tokens and wearable NFTs that wallet holds, because “users truly own their digital assets… with ownership registered on the blockchain” . You can also see every transaction (like transfers of MANA, purchases of items) – nothing is hidden behind the company’s database. The challenge here is connecting the wallet to the human: wallets are pseudonymous by default. But if the person ever linked it to an ENS name or used it on a social platform, you can make that connection. Investigative tools for blockchain worlds often include Etherscan (for Ethereum-based assets), Polygon’s explorer (Decentraland uses Polygon for some assets), Dune Analytics (which has community-made dashboards, e.g., a Dune dashboard might show “Top Land Owners in Sandbox” or “Activity of Decentraland Names”), and NFT aggregators. You typically do not have a built-in notion of “friends list” or chat history to examine, because those social features happen off-chain (e.g., Decentraland chat goes through their servers and is not logged publicly). So you lean on asset and transaction data and whatever the user voluntarily shares externally.

• Centralized Metaverses (Roblox, VRChat, Fortnite Creative, Rec Room, etc.): These platforms have traditional account systems (email/username login) and store data internally. Public data is what the platform chooses to expose in profiles or via APIs. Roblox is notably open in some respects: user profiles list creations and collectibles, and Roblox has APIs that return data like a user’s friends, the games they’ve visited recently (if you have an API key or use certain endpoints), etc. There are also fan-made databases of Roblox user stats. VRChat is more closed – no public friend lists or play history. However, VRChat’s API (if one reverse-engineers it) can tell if a user is online and in which world, if you have their API key and account auth (this is more advanced and not in the realm of “public” since it requires login). But VRChat does have public content listings (worlds and avatars that creators choose to share in public portals). Investigating a VRChat user often means looking at where they hang out (maybe they always join a certain DJ night – you find their name on an event flyer) or if they create content. Spatial and similar newer platforms often blend aspects: you can log in with an email or with a crypto wallet depending on user choice. If they logged in with a wallet, you can then do blockchain OSINT; if with email, you rely on what they showcase on their profile.
  One important note: centralized platforms sometimes have developer forums or user communities where people use the same username. For instance, Roblox has the DevForum where developers discuss and often their DevForum username is the same as their Roblox username (and sometimes they sign posts with their real name or link their portfolio). VRChat has a community forum and many users there might reveal more about themselves. Including these in your search can help bridge identities (e.g., a Roblox user might have a DevForum thread where they announce a game and provide a Discord link or personal website).

• Privacy Differences: Generally, blockchain metaverses are more transparent about assets, while traditional platforms are more transparent about social connections. In a blockchain world, I can easily see what you own but not who you talk to. In Roblox/VRChat, I can often see who your friends are or what group you’re in, but not the details of your inventory unless it’s made public. Each platform also has its terms of service and privacy rules, so keep in mind that just because you can see something publicly doesn’t mean the user realizes it’s public. Always use information responsibly.

To illustrate, consider an example comparison: If Alice has a foot in both Decentraland and Roblox, an investigator can see her Decentraland wallet bought two land parcels and a rare hat (since those are on Ethereum), and also see that her Roblox account (say, “Alice_Wonder”) is in the “VR Enthusiasts” group and has 50 friends visible, one of whom is likely her alternate account (maybe named AliceDev). The investigator would use blockchain tools for the former and the Roblox website or API for the latter. Both streams of information together provide a fuller profile of Alice’s virtual life.

Tips, Tools, and Resources (Free) for Metaverse Investigations

Finally, let’s compile a list of free tools and resources that can aid your metaverse sleuthing. These tools require no paid subscriptions:

• Search Engines & Operators: Google, Bing, DuckDuckGo – use keywords, quotes for exact username searches, and platform-specific operators (site:roblox.com, site:decentraland.org, etc. to narrow results). Don’t underestimate simple searches.

• Blockchain Explorers:
  

  • Etherscan (for Ethereum) and Polygonscan (for Polygon) – indispensable for looking up wallet addresses, token holdings, ENS names, and transaction history. You can input an address and see all ERC-20 tokens (like MANA, SAND) and ERC-721/1155 NFTs it holds, along with past transactions. Look at the “Analytics” tab on Etherscan for any unusual spikes in activity.

  • Blockchair or Solscan – if you need to search other chains (Blockchair can search across multiple blockchains for an address or transaction).

  • ENS Lookup: Use Etherscan or the official ENS App to find info about an ENS domain (owner address, and any text records it might have).

• NFT Marketplaces and Aggregators:
  

  • OpenSea – search by wallet address or username. Many users have OpenSea accounts that show their collections. You can also search collections like “Decentraland LAND” or “Decentraland Names” or “Sandbox’s LAND” and then filter for the owner’s address to see which ones they own.

  • LooksRare, X2Y2 – other NFT marketplaces if OpenSea doesn’t show something (but OpenSea is the broadest).

  • RARIBLE – sometimes people list items on Rarible or have a profile there.

  • Nonfungible.com – a site that tracks NFT markets and can sometimes let you look up an address to see what NFTs it has across several collections.

  • Dune Analytics – community-made dashboards (free to use). Search the Dune site for dashboards related to Decentraland or Sandbox; for example, there might be a dashboard listing top landowners or recent sales, which can save you time.

• Metaverse Platform Tools:
  

  • Decentraland Atlas / Marketplace – the official Decentraland marketplace (market.decentraland.org) lets you search for names, view accounts (addresses) and their assets (under the “Account” section if you plug in an address or name). The Atlas view shows land parcels and their owners.

  • The Sandbox Map – on sandbox.game, the interactive map lets you click owned lands to see owner addresses or names (some lands are owned by known partners and show a name). The Sandbox also has a section for user profiles if you know the nickname (some creators have public profiles).

  • Roblox Website & APIs: The Roblox profile page itself is a primary tool (just go to roblox.com and search the username). For deeper info, Roblox has APIs (for example, you can fetch a JSON of a user’s friends by a call to friends.roblox.com/v1/users/[userid]/friends). There are third-party wrappers and tools like RoSearcher (a browser extension to find which game server a user is in) that can be used to see if they are currently playing something. Rolimon’s (rolimons.com) is a fan site listing Roblox inventories (especially limited items) and user value rankings. It’s free to use and great for seeing if someone has rare items.

  • Namechk / Sherlock – as mentioned, for scanning username availability across platforms (this can hint if the person likely reserved their name on multiple sites).

  • Social Media Search: Use Twitter’s search and even advanced search. Many metaverse projects have official hashtags (e.g., #Decentraland, #RobloxDev). If you search the username or wallet address on Twitter, you might find posts like “my wallet 0xABC… got a new NFT” or someone asking for help with something.

  • Discord Communities: Many metaverse communities live on Discord (Decentraland, Sandbox, etc. have official servers). While Discord messages aren’t indexed on search engines, some servers have public channels that are visible or are logged by bot websites. You can also join these servers (free) and use the Discord search within them. Searching for the username or ENS there could show if they said anything or if others mentioned them (like @username).

  • Forums and Q&A: Reddit, StackExchange (there is a StackExchange for Ethereum where sometimes people discuss ENS and such, possibly revealing their addresses), and platform-specific forums (Decentraland Forum, Roblox DevForum, etc.). Use their internal search or Google’s site search to find the alias.

• POAP Tools:
  

  • POAP Scan (poap.scan or the POAP app) – enter an Ethereum address or ENS and see the list of POAPs (event badges) it holds .

  • POAP Gallery – a visual way to see collections of POAPs by address .

  • These help confirm event attendance and sometimes the POAP itself has clues (the artwork or title might reveal what kind of event or which community hosted it).

• OSINT People Search Tools: If you’ve moved from the virtual identity to a real name, tools like BeenVerified, Spokeo, etc., are beyond our scope (and often paid). But you can use free resources like simply Googling the real name with “gamertag” or using LinkedIn to see if they mention metaverse skills. This is more if you already suspect a real person behind the avatar and want to verify. For example, if the username is unique, search it on LinkedIn – some developers put their gamer tag in their profile.

• Wayback Machine (Internet Archive): If you suspect a user profile or marketplace listing was changed or removed, the Internet Archive might have snapshots. For instance, if a Decentraland land was listed for sale and then delisted, a cached page might still show the price or owner at that time.

• On-chain Analysis Tools: If you want to go deeper and the free resources above are not enough, there are advanced (sometimes freemium) tools like Breadcrumbs.app (for visualizing connections between crypto addresses) or OnChain analytics platforms. However, these might be overkill for simple investigations and can have costs. Wherever possible, rely on the free basics first (the blockchain is free to query!).

Example Use of Tools: Let’s say you have a crypto wallet address from a tip that “Alice is into metaverse stuff.” You plug it into Etherscan – you find the address has an ENS name alicewonder.eth and holds 2 Decentraland LAND tokens, 5 wearable NFTs, and some MANA. You use OpenSea to see those LAND tokens – they correspond to parcels (10,10) and (10,11) in Decentraland. You visit the Decentraland Atlas, find those parcels are adjacent and form an estate named “Wonderland Gallery.” You go to Decentraland (even without logging in, you can use a guest login) and visit that location – you see a gallery build with a sign “Wonderland Gallery by Alice (Twitter: @AliceArt)”. Now you have her Twitter handle. You check her Twitter, and indeed she often posts about her Decentraland gallery and also mentions her Roblox game development. You search her Roblox username (which you guess might be “AliceWonder” from her Twitter bio) on Roblox.com and find a matching account with several games published. This cascade of discoveries was done with simple tools: Etherscan, OpenSea, the Decentraland client, and web searches – all free and open.

In summary, investigating a person’s metaverse activity involves a mix of blockchain sleuthing and traditional OSINT techniques. By following asset trails on public ledgers, scouring user profiles on gaming platforms, and connecting the dots through social media, you can often build a comprehensive picture of someone’s virtual world footprint. Always remember to respect privacy and use this knowledge responsibly – everything we’ve discussed is about using publicly available information, which the person themselves has either deliberately shared or is inherent to how these platforms operate. Happy exploring, and may your searches unveil the virtual footprints you’re looking for in the ever-expanding metaverse!

Like the blog? Buy the author’s book!

The OSINT Guide - Check it out on Amazon - 4.5 stars!

“Tom Caliendo‘s latest contribution to the field, The Open Source Intelligence Guide stands as a beacon for those looking to delve deeper into the internet’s hidden layers.”

Tracing In-World Activity and Assets

Once you’ve identified the person’s metaverse account or wallet, you can start uncovering what they’ve been up to. Different types of data are publicly available depending on the platform:

• Virtual Land Ownership: In blockchain-based worlds, land ownership is transparent. Decentraland and The Sandbox both have public maps and blockchain records of land. You can go to Decentraland’s official map (called Genesis City map) or The Sandbox’s map and click on parcels to see the owner’s wallet address or nickname. If you prefer blockchain data, each LAND token is an NFT that contains metadata of coordinates and the owner’s address . For example, using Etherscan on the Decentraland LAND contract, you can query which address owns a particular parcel ID, or list all tokens owned by the person’s address. Decentraland’s LAND Manager or marketplace will show all parcels a given address owns when you connect that address. In The Sandbox, the website’s profile for a user (if they log in with a wallet) might list owned lands and assets. Alternatively, on OpenSea you can view “The Sandbox LAND” collection filtered by owner address. Virtual real estate transactions are also public – if the person bought or sold land, you can see transaction dates and prices on the blockchain or in marketplace transaction history (OpenSea shows past sale events for NFTs).

• Avatar Customizations and NFTs: Many metaverses use NFT items for avatar wearables, accessories, or even avatar itself. In Decentraland, wearables (clothes, hats, etc.) are NFTs minted on Ethereum or Polygon (Decentraland moved wearables to Polygon for lower fees). You can see which wearables the person’s wallet owns – these might show up in their OpenSea collection or on the Decentraland marketplace under their address. This can tell you how they dress their avatar or which limited-edition items they obtained. For instance, if you see they own a “MetaZoo Shirt (Rare)” wearable NFT, you know they either bought it or were perhaps involved in an event where it was given out. In non-blockchain platforms like Roblox, avatar items aren’t NFTs on a public chain, but you can often view a user’s inventory of collectibles. Roblox profiles have a section for the user’s “Inventory” (if not hidden by privacy settings) where you might see what badges, accessories, or game trophies they have. You might discover they earned a badge for attending a Roblox event, or they have rare limited items (Roblox limiteds are items that can be resold and are tracked publicly). Third-party sites like Rolimon’s track Roblox limited item ownership – by searching the username there, you can see which limiteds they own and their market values.

• Event Attendance: How can we tell if someone attended a virtual event? In some cases, event participation leaves traces:
  

  • In blockchain metaverses, a popular method is POAP – Proof of Attendance Protocol tokens. POAPs are a type of NFT that allows people to prove they attended digital or in-person events . Many Decentraland events (concerts, festivals, conferences) distribute POAP badges to attendees (these are free NFTs, often minted on a sidechain like Gnosis Chain). If the person’s wallet has POAP NFTs, each token usually has the event name and date in its metadata. For example, if you see a “DAO Voting Party 2024 POAP” in their wallet, they were at that event. You can use a site like poap.xyz or poap.gallery to look up an address or ENS name and see all associated POAPs, which effectively gives you a timeline of events they joined. This is a very powerful way to trace someone’s engagement in community gatherings, virtual conferences, or launch parties in the metaverse. It’s like seeing their collection of ticket stubs – and it’s public.

  • In non-blockchain platforms, event tracking is less straightforward because there isn’t an equivalent of a POAP in most cases. However, some games give badges or achievements for attending events. For instance, Roblox might give a badge if you participated in the Lil Nas X Concert experience or a special Roblox developer conference world. These badges show up on the user’s profile under “badges” and are visible to others. So check their profile for any event badges. Additionally, you might rely on social clues: people often tweet screenshots from events or join specific event-related groups which remain on their profile.

  • Another indirect method: search for the person’s username in context of the event. E.g., if you know they might have gone to “Metaverse Fashion Week”, search “AliceWonderland Metaverse Fashion Week Decentraland” – you might find a list of attendees or a recap where they’re mentioned. Sometimes event organizers publish lists of winners or notable attendees (especially if your target person is a known figure, they could be mentioned in a blog).

• Marketplace Activity and Commerce: If the person buys or sells virtual goods, there can be trails:
  

  • On blockchain marketplaces, every sale or purchase is a transaction you can see. If their wallet bought a wearable NFT or sold one, you can find that on Etherscan or the marketplace’s transaction history (OpenSea, Decentraland marketplace, etc., often list recent sales). You might see they paid X MANA for a jacket wearable on a certain date. This tells you not just what they own, but also their trading activity and maybe how much they’re investing.

  • If they create content for sale (like designing an NFT wearable or building and selling a custom VRChat avatar), look for evidence of that. Decentraland creators are listed on the wearable NFT metadata (it will say “Creator: [address]”). If you see the person’s address as a creator of items, they’re not just participating but contributing content. In The Sandbox, if they made a custom asset (say a 3D model NFT), the Sandbox marketplace or OpenSea would list their address as creator. On Roblox, check if they have any Creations (Roblox profile has a “Creations” tab showing games they made or assets they published in the marketplace). Their created games might show how many visits they have or if they earn Robux (Roblox’s currency) from them, which indicates commercial activity. On VRChat, see if they authored any worlds (some VRChat world listing websites or the VRChat SDK’s content manager might credit the creator by username).

• Social Connections (Friends and Groups): Understanding whom the person interacts with in the metaverse can also be revealing. Different platforms handle this differently:
  

  • Friends Lists: On some platforms, friends lists are public. For example, by default Roblox shows a user’s friends list and the groups they belong to on their profile to anyone who logs in . If you visit their profile, you can scroll to see “Friends” and “Groups.” This can tell you who they hang out with or what communities they’re part of (perhaps they’re in a Roblox group for a particular game or clan). Note that privacy settings can hide this, but many users don’t change the default. As an investigator, seeing their friends could lead you to other accounts or alternate identities (maybe they have a second account that is friends with the first, or you find a friend’s profile that mentions your target in the description). In Decentraland and Sandbox (blockchain worlds), “friends” aren’t recorded on-chain; friendships are usually just within the platform’s social server and not publicly visible by default. VRChat profiles can show friends but only to the user themselves or those they allow. So, for blockchain metaverses, you typically won’t have a public friends list to inspect.

  • Groups/Guilds: Many metaverse users join groups – e.g., Roblox developer forums, VRChat community groups, Discord servers for Decentraland creators, etc. Publicly, Roblox groups are visible on profiles. If the person is in a group like “Decentraland Builders Guild” or “Roblox Dev Forum Members”, that ties them to certain activities or interests. Similarly, check if they have any affiliation listed (some users mention a crew or guild in their bio).

  • Interactions via Blockchain: A subtle form of social connection in blockchain worlds is looking at transaction partners. If the person’s wallet frequently sends NFTs or currency to another specific wallet, that could be a friend or an alt account. Etherscan can show all transactions – you might notice they repeatedly transfer tokens to another address (perhaps moving assets to a main wallet, or trading with a specific user). While this doesn’t give a name, it provides leads (you could investigate that other wallet to see if it has an ENS name or other identity clues).

  By compiling these aspects, you start to build a picture of the person’s metaverse life: what property they own, what events they attend, what items they collect or trade, and who they mingle with. All of this is done with public data – blockchain records, user profiles, and search engines – no hacking or private data needed.

Part 3 next week will be:

Metaverse to Real-World: Tracing an Avatar or Asset Back to a Person

This is the first of four posts on OSINT investigation in the metaverse.

Investigating someone’s activity in the metaverse involves piecing together clues from various online platforms and blockchain data. The metaverse refers to virtual worlds where people socialize, play, or do business through avatars – examples include blockchain-based worlds like Decentraland and The Sandbox, as well as non-blockchain platforms like Roblox or VRChat. Much of this activity leaves public traces, either on the open internet or on public blockchain ledgers. In this guide, we’ll explain how to use free, publicly available tools and techniques to determine if someone is active in the metaverse, trace their in-world activities (like virtual land ownership or event attendance), and even connect their virtual identity to real-world or social identities. All of this will be done with open-source intelligence (OSINT) methods – using information anyone can access legally. We’ll cover two investigative approaches (starting from a known person vs. starting from a metaverse identity), highlight what metaverse data is public, compare different platforms, and suggest free tools to support your investigation. The language here is kept clear and simple for non-technical readers, with examples to illustrate each point.

Like the blog? Buy the author’s book!

The OSINT Guide - Check it out on Amazon - 4.5 stars!

“Tom Caliendo‘s latest contribution to the field, The Open Source Intelligence Guide stands as a beacon for those looking to delve deeper into the internet’s hidden layers.”

Getting Started: What Information Do You Have?

Begin by gathering whatever clues you already have about the person’s possible metaverse presence. Common starting points are:

• Username or Alias: Perhaps you know a handle or nickname they use online.

• Avatar or Character Name: Maybe you’ve seen their avatar or know the name of their character in a game/world.

• Crypto Wallet Address or ENS Name: In blockchain-based metaverses, activity is often tied to a cryptocurrency wallet (a long string starting with “0x” for Ethereum addresses) or an ENS domain name (like username.eth).

Each type of information can be a key to unlock further details:

• Usernames: If you have a username, try searching for it on Google or another search engine in quotes. Include keywords like the platform name. For example, search “AliceWonderland Decentraland” or “AliceWonderland Roblox profile”. This may lead to forum posts, social media profiles, or user directories. You can also use free username search tools (like the open-source Sherlock or WhatsMyName repositories) which check if that username exists on hundreds of platforms . Many people use the same alias across multiple sites; finding a match on a metaverse platform’s site or related forum can confirm they are active there.

• Avatars or Images: If you have an image of the person’s avatar, perform a reverse image search (e.g. using Google Images or Bing Images). This could lead to pages where that image appears – perhaps a profile picture on a forum, or a tweet where they shared a screenshot. Even if the avatar is a cartoon or 3D character, you might discover it’s a unique NFT image or a popular avatar design linked to a creator. For example, a distinctive avatar outfit in Decentraland might be an NFT wearable – if you identify that wearable, you can find who owns it or created it on the blockchain (more on this later).

• Crypto Wallet Addresses / ENS: A wallet address (like an Ethereum address) is a treasure trove of public data. Because most metaverse projects on web3 use public blockchains, anyone can inspect transactions and assets for a given address . If you have an address or an ENS name (Ethereum Name Service domain), use a blockchain explorer such as Etherscan (for Ethereum) or Polygonscan (for Polygon) to see what tokens it holds and what transactions it has made. Look for clues in the list of tokens: Do they hold metaverse tokens (e.g. Decentraland’s MANA or Sandbox’s SAND)? Do you see any NFTs that correspond to metaverse items (like virtual land or avatar wearables)? For example, Decentraland’s virtual land parcels are represented by LAND tokens on Ethereum; if the wallet holds Decentraland LAND NFTs, that’s a strong indicator of metaverse activity. In fact, each Decentraland LAND token publicly records its coordinates and owner on Ethereum . Similarly, The Sandbox’s land parcels are also Ethereum NFTs. A wallet might also hold a Decentraland NAME NFT – Decentraland allows users to register a name (their avatar’s username) as a blockchain asset . If you see something like Alice in their NFT list under a “Decentraland Names” collection, that means the person owns the avatar name “Alice” in Decentraland (these name tokens are even integrated with ENS, meaning they can potentially be used across Web3 ). An ENS name itself (like alice.eth) might be used as a username in some metaverse platforms or could point to a profile. In short, analyzing a wallet can quickly tell you if that person is involved in blockchain-based metaverses and even hint at which ones .

Gather as many of these starting clues as possible. Once you have a lead (username found on a platform, a wallet with interesting tokens, etc.), you can move to the next phase: digging into their metaverse activity.

Real-World to Metaverse: Finding Someone’s Virtual Presence

This approach assumes you start with knowledge of the person (or at least their online alias) and want to find if they have a metaverse presence.

1. Search Social Media and Forums: Often the easiest clue comes from the person’s own mentions. Check their Twitter (X) feed, LinkedIn, Instagram, or any blog for keywords like “metaverse”, “Decentraland”, “Roblox”, etc. People who are proud of their virtual activities may talk about events they attended or assets they bought. For instance, someone might tweet “Excited to attend the concert in Decentraland tonight!” or “Just bought land in The Sandbox.” These posts not only confirm their involvement, but may also include their username or the name of the event which you can follow up on. If the person has a common handle, try searching that handle along with metaverse terms (e.g., “AliceWonderland VRChat avatar”).

2. Identify Platform-Specific Usernames: If the person is active in a metaverse, they likely have a username or avatar name on that platform. Sometimes people use the same username as their Twitter or gaming handle. If you suspect a platform, go to that platform’s user search or directory. For example:
   

   • Decentraland – Users can have a name NFT as mentioned. You might search Decentraland’s Marketplace for that name (there’s a section for Names, or use OpenSea to search within the “Decentraland Names” collection for the alias).

   • Roblox – Use Roblox’s website search to find a user by username (simply visiting https://www.roblox.com/users/username/profile or using their search bar). Roblox profiles are public by default; even without being friends, you can usually see their profile info.

   • VRChat – VRChat has a user search in the application (or via their web API if you have an account). If you know their VRChat username, you could try logging into the VRChat home page and searching for that user to send a friend request or see their public profile (it might show their status or perhaps avatars/worlds they share).

   • Spatial – Spatial might not have a public directory, but if the person hosted a gallery or space, it could be listed on Spatial’s site or they might have shared a link. Searching their name plus “Spatial gallery” could yield results if they created a public space.

3. Leverage Cross-Platform Username Searches: Free tools like Namechk or WhatsMyName can search for accounts on many services by username. While these focus on popular social networks, they often include gaming platforms like Roblox or others . If the person’s alias is unique, you might find hits on sites like Reddit (maybe in r/Roblox or r/Decentraland subreddit posts), on the Decentraland DAO forum (where wallet addresses or names appear if they’ve voted or commented on proposals), or on community Discord servers (some Discord user lists are indexed by search engines if they have web chat, though this is less common).

4. Use Wallet and NFT Clues: If you have identified a likely crypto wallet for the person (from an ENS name they share or a transaction you found), dive deeper with that. For example, on Etherscan, look at the wallet’s ERC-721 (NFT) tokens. If you see something like “Decentraland LAND” or “TheSandbox LAND”, that’s a direct confirmation. You can even see the token IDs which correspond to specific parcel locations. Check ERC-20 tokens too: holding lots of MANA (Decentraland’s currency) or SAND (The Sandbox’s currency) strongly suggests involvement. Keep in mind some metaverses use other blockchains (for instance, some newer metaverse projects might be on Solana or Binance Chain). Use the appropriate explorer for those (e.g., Solscan for Solana addresses). Many blockchain explorers also show labels – if an address is known, Etherscan might label it (e.g., an address that is a major NFT collector or an exchange). Occasionally, investigators get lucky and find an address that has an obvious ENS or was named by the user in a blockchain name service, directly tying it to them.

5. Check NFT Marketplaces: On platforms like OpenSea, you can search by username or wallet address. Users can set a profile name on OpenSea; some use their Twitter handle or ENS name. If you know their alias, try searching OpenSea – you might find a profile where they showcase their NFTs, which could include metaverse items. For instance, if “AliceWonderland” has an OpenSea profile with a Decentraland avatar wearable and a bio that says “Decentraland builder”, you’ve found a link. Also, OpenSea’s account page for a wallet will often display the ENS name (if the wallet has one) and all NFTs owned. This can reveal all sorts of metaverse-related assets (land, avatar wearables, event tickets, etc.).

By the end of this phase, you should have a clearer idea if the person is active in any metaverse platform and under what identity (wallet/address or username). Now, let’s say you found them – for example, you confirm that AliceWonderland owns Alice.dcl (a Decentraland name) and some land NFTs, or that they have a Roblox account with the same name. Next, you want to trace their activities within those metaverse worlds.

The next three sections scheduled each week will be:

Tracing In-World Activity and Assets

Metaverse to Real-World: Tracing an Avatar or Asset Back to a Person

Platform Comparisons: Blockchain vs. Non-Blockchain Worlds

In the ever-expanding world of cryptocurrency, sharing wallet addresses online has become common practice. Crypto enthusiasts, developers, and influencers often share their wallet details for donations, community support, or to receive payments for various services. These wallet addresses are openly shared on multiple social media platforms, each serving as a hotspot for the crypto community to engage, discuss, and transact.

This article explores the social media platforms where cryptocurrency wallet addresses are most commonly found, along with strategies to locate them efficiently. We will also highlight some key tools for deeper investigations, including GitHub and its unique advantages.

The world of cryptocurrency and NFTs (Non-Fungible Tokens) is vast and complex, and uncovering information about these digital assets requires a mix of skill, creativity, and the right tools. Social media platforms, particularly Facebook, serve as a treasure trove for investigators looking to learn more about crypto wallet addresses, NFT collections, and the networks surrounding them. In this guide, we will start by walking you through a comprehensive approach to utilizing Open Source Intelligence (OSINT) techniques for investigating crypto wallets and NFTs on Facebook. From exploring profiles and groups to diving into live streams and Facebook Marketplace listings, we’ll cover a variety of methods to help you navigate this space.

I’m excited to announce the release of my new book,
Cryptocurrency Investigations: A Step-by-Step Guide to Tracing Digital Assets and Tracking Down Their Owners. Check it out on Amazon: https://www.amazon.com/dp/B0DJ1BN7ZM

This comprehensive guide is designed to help investigators, analysts, and anyone interested in the crypto space navigate the complexities of tracing digital assets and uncovering the identities behind them. Whether you’re new to crypto or a seasoned investigator, I hope you’ll find valuable insights and practical strategies inside.

Why Are Wallet Addresses Shared on Social Media?

People share their crypto wallet addresses for a variety of reasons:

1. Receiving Donations or Tips: Influencers and content creators often provide their wallet addresses to receive support or tips from their followers.

2. Community Engagement: Engaging in community events, challenges, or competitions often requires participants to share their wallet addresses for receiving rewards.

3. Transparency and Crowdfunding: New crypto projects or decentralized finance (DeFi) initiatives may share wallet addresses for transparency, allowing potential backers to track funds or contribute to the project.

These practices make social media platforms critical places to look for wallet addresses and track crypto transactions.

Key Platforms for Finding Cryptocurrency Wallet Addresses

1. Twitter (X)

Known for its real-time updates and rapid sharing of information, Twitter is a key platform for the crypto community. Users share wallet addresses for everything from donations and fundraising to participating in crypto giveaways and challenges.

How to Find Wallet Addresses on Twitter:

• Search Hashtags and Keywords: Use hashtags like #cryptodonation, #walletaddress, #BitcoinAddress, or coin-specific tags (e.g., #Ethereum) to find wallet addresses shared in tweets.

• Engage with Influencers: Many crypto influencers share their wallet addresses in their posts to receive donations or to distribute tokens as part of a community event.

• Participate in Giveaways and Contests: Wallet addresses are frequently shared in response to crypto giveaways, airdrops, or challenges announced by users.

Example: A tweet might read, “Support my work by donating to my BTC wallet address below. Thank you!” followed by the wallet details.

2. Reddit

Reddit is home to a vast array of crypto-focused subreddits, such as r/cryptocurrency, r/Bitcoin, and r/Ethereum, where users often share their wallet addresses for various purposes including tipping, donations, and community events.

How to Find Wallet Addresses on Reddit:

• Search Specific Subreddits: Use the search function within subreddits like r/cryptocurrency, r/CryptoMarkets, or r/CryptoCurrencyTrading to find posts mentioning wallet addresses.

• Look for Tipping Bots: Some subreddits allow tipping using bots (like Tippr) which require users to share their wallet address.

• Watch for Crowdfunding or Donation Posts: Users may share their wallet details for donations or support for personal projects or charitable causes.

Example: A Redditor may post, “Raising funds for a blockchain project! Any contributions are appreciated! Here’s my wallet address…”

3. Telegram and Discord

Telegram and Discord serve as central hubs for crypto communities, with groups and servers dedicated to specific cryptocurrencies, trading, or blockchain projects. Wallet addresses are often shared within these communities during group discussions, airdrops, and community fundraising.

How to Find Wallet Addresses on Telegram and Discord:

• Join Crypto-Focused Groups or Servers: Once part of relevant groups or servers, check pinned messages or scroll through chat histories to find wallet addresses.

• Watch for Announcements and Discussions: Wallet addresses are often shared as part of project announcements or community discussions, especially in project-specific groups.

• Participate in AMAs and Events: During AMAs (Ask Me Anything sessions) or live events, users and project teams may share wallet addresses for community support or transactions.

Example: An admin of a Telegram group might say, “For those interested in donating to our project, please use the wallet address below.”

4. GitHub

GitHub is a critical platform for crypto developers, project managers, and contributors to collaborate on open-source projects. Not only can you find wallet addresses shared as part of donation requests for projects, but GitHub also offers opportunities to uncover user details, such as email addresses, which can link back to wallet information.

How to Find Wallet Addresses on GitHub:

• Browse Repository Readme Files or Documentation: Some developers share wallet addresses in the README.md file for donations or project support.

• Check Contributor Comments or Issues Sections: Wallet addresses may be shared in the comments of issues, pull requests, or project discussions.

• Find User Information via Email Lookup Tool: You can use tools like GitHub Email Finder to potentially locate the email address of a GitHub user by entering their username. The email address might provide additional clues or links to their wallet address shared on other platforms.

Example: A project’s README might include: “Support our development with donations. BTC wallet: [address].”

Best Practices for Finding Wallet Addresses on Social Media

1. Leverage Platform-Specific Hashtags and Keywords: Use hashtags and search terms that are relevant to crypto transactions (e.g., #walletaddress, #cryptodonation) to discover posts quickly.

2. Engage with Communities: Join relevant groups on Telegram and Discord, follow crypto influencers on Twitter, and participate in Reddit discussions to immerse yourself in wallet-sharing discussions.

3. Track Projects and Influencers: Following specific crypto projects, influencers, or subreddits can lead you directly to wallet addresses, especially if they are accepting support or hosting events.

4. Stay Updated with Real-Time Announcements: Many wallet addresses are shared in real-time events like AMAs, Twitter spaces, or community challenges, so staying active on these platforms will help you find addresses as they are posted.

Situations Where Wallet Addresses Are Commonly Shared

1. Support for Content Creators or Influencers: Influencers on Twitter or Reddit often share their wallet addresses to receive donations for their content or community contributions.

2. Project Crowdfunding and Token Sales: New crypto projects share wallet addresses for funding, either on GitHub, Telegram, or other social platforms.

3. Tipping and Rewarding Community Members: On Reddit, users share their wallet addresses to receive tips for valuable contributions using tipping bots.

4. Airdrops and Giveaways: During airdrops or crypto giveaways, users often share wallet addresses in public comments or group chats to receive their rewards.

Conclusion

Sharing wallet addresses on social media platforms like Twitter, Reddit, Telegram, Discord, and GitHub is a common practice in the cryptocurrency world. By leveraging platform-specific search techniques and following the right communities and influencers, you can efficiently find wallet addresses to track crypto transactions, engage with communities, or support content creators.

Understanding how to navigate these platforms allows for more effective discovery and tracking of wallet addresses, offering transparency and insight into the cryptocurrency ecosystem. With the right strategies, it is possible to find publicly shared wallet addresses without any privacy violations.

Investigating Cryptocurrency Using Reddit: A Step-by-Step Guide

Reddit is a vast source of open-source intelligence (OSINT) where users often share details about cryptocurrency projects, trades, scams, and discussions that can be invaluable for an investigator. With the right approach and tools, you can uncover relevant information hidden within the platform. This guide will provide step-by-step instructions for using specific tools to investigate cryptocurrency topics on Reddit.

1. Using Google Search to Search Reddit

Reddit’s internal search can be clunky and incomplete. A more effective way to search Reddit is through Google:

• Use the search operator site:reddit.com to limit results to Reddit.

• To search for a specific keyword or topic, type site:reddit.com [keyword].

• To search for a Reddit user, use site:reddit.com/user/ "[username]". This is helpful for locating discussions tied to a specific user across different subreddits.

2. User Analyzer

URL: reddit-user-analyser.netlify.app

This tool provides a breakdown of a Reddit user’s activity, giving insights into their posting patterns and engagement. It’s straightforward to use:

• Enter the Reddit username you want to analyze.

• View the results showing the user’s comment history, popular posts, and activity by subreddit.

3. RedditMetis

URL: redditmetis.com

RedditMetis allows you to pull the last 1,000 comments and 1,000 submissions from a Reddit user’s account history, complete with user statistics. It uses natural language processing to infer a user’s interests and possible possessions.

• To start, input a Reddit username.

• Results show the user’s comment history, subreddits they engage in, and even some analysis on their likely preferences or behaviors.

• You can also go straight to results by customizing the URL like this: https://redditmetis.com/user/[username], e.g., https://redditmetis.com/user/didyouseethatpotato.

4. Redective

URL: redective.com

Redective provides a way to search for Reddit users and keywords across different subreddits.

• Enter either a username or a keyword into the search field.

• Use the dropdown to select what type of data you’re seeking (posts, comments, etc.).

• Hit search to view results tied to your query.

5. Reveddit

URL: reveddit.com

Reveddit helps recover deleted Reddit content, which can be crucial in cryptocurrency investigations when users delete posts or comments that may contain valuable information.

• Enter a Reddit username into Reveddit to view their deleted content.

• The tool will display removed posts and comments, allowing you to see what was hidden.

6. ReSavr

URL: resavr.com

ReSavr is another platform for retrieving deleted Reddit content, focusing on longer comments (over 1,000 characters).

• Simply use the platform to see deleted comments, which are often the ones containing more detailed or insightful information.

7. Reddit Post Analyzer

URL: osintcombine.com/reddit-post-analyser

Provided by OSINT Combine, this tool is designed to analyze individual Reddit posts.

• Enter the URL of a specific Reddit post you wish to investigate.

• The tool will analyze the post, returning results that include insights on the content, user interactions, and related discussions.

Conclusion

By leveraging these tools, you can efficiently uncover information related to cryptocurrency discussions, user behaviors, and even deleted content on Reddit. Each tool has its specific strengths, whether you are tracking down user activity, identifying key discussions, or retrieving hidden information. With these step-by-step techniques, Reddit can become a highly valuable source of intelligence for your cryptocurrency investigations.

Cryptocurrency Investigations: Tips, Tools, and Techniques

If you're diving into a cryptocurrency investigation, Twitter is one platform you simply can't ignore. The microblogging giant is a hub for real-time discussions, breaking news, and unfortunately, a breeding ground for scams and manipulations in the crypto space. But what makes Twitter so unique, and how can you navigate its complexities to enhance your investigative work? In this article, we’ll explore advanced techniques, powerful tools, and actionable strategies to boost your cryptocurrency investigations using Twitter.

1. Analyzing Hashtags and Trends

Tracking Hashtags for Crypto Insights

In the crypto world, hashtags are gold mines. Discussions often center around hashtags like #Bitcoin, #Ethereum, or #CryptoScam, which can help investigators follow the pulse of the community. By tracking these hashtags, you can pinpoint trending topics, identify new projects, and uncover scam alerts. Use tools like TweetDeck or Hashtagify to keep tabs on relevant hashtags in real time.

Monitoring Trends for Real-Time Updates

Twitter's "Trends" feature or third-party apps like Trendinalia can help investigators understand what's buzzing in the crypto world. Spotting trends early can lead you to emerging news or suspicious activities before they become widespread. Keep an eye on spikes in conversation volume—these could signal market manipulation or a developing scam.

2. Monitoring Influencer Accounts and Networks

Mapping Out Key Influencers

Crypto influencers wield a massive impact on public sentiment and even market prices. Think of analysts, project founders, and "crypto whales" with thousands, even millions, of followers. Use tools like Followerwonk to map their networks and assess how they may be shaping narratives, promoting specific coins, or driving disinformation.

Follower and Retweet Analysis

Not every follower is who they claim to be. Analyze the activity of those who frequently retweet or interact with key influencers. Often, you can identify patterns indicating bot activity, fake accounts, or coordinated shilling campaigns that are pushing fraudulent projects or pump-and-dump schemes.

3. Sentiment Analysis for Market Movements

Using Text Sentiment Tools

Sentiment analysis is like reading between the lines of tweets. Tools like Tweepy, VADER, or Topsy allow you to gauge the emotional tone surrounding a specific coin or topic. Are the tweets largely positive, hyped up with "to the moon" enthusiasm? Or are they laden with warnings of scams and downturns? This insight can be crucial in understanding potential market shifts or coordinated disinformation campaigns.

Decoding Emojis and Language in Crypto Chats

In the crypto world, emojis aren't just fun—they have meaning. Rocket ships (🚀) and moons (🌕) often indicate excitement around a coin, suggesting it’s about to “take off.” On the flip side, hashtags like #rugpull or #scam might hint at fraudulent activity. Understanding these subtle signals can give you the upper hand in detecting sentiment and intent.

4. Network Mapping and Connection Tracing

Using Social Network Analysis (SNA)

The crypto community is tightly interconnected, and mapping these relationships can be revealing. Use social network analysis tools like Gephi to visualize the interactions—retweets, mentions, replies—between users. This can help uncover clusters of coordinated behavior, identify ring leaders of disinformation campaigns, or track how scams spread across networks.

Tracing Information Cascades

Want to know how a rumor started and who spread it? Tools like TweetReach allow you to track how far a piece of information has traveled and identify key accounts that amplified it. This helps in uncovering the origins of potential misinformation or pump-and-dump cycles in crypto.

5. Bot and Fake Account Detection

Spotting Bots with Bot Detection Tools

The crypto world on Twitter is teeming with bots—accounts designed to amplify specific narratives. Tools like Botometer and Foller.me can help you detect bot-like behavior by analyzing patterns in account activity. For example, if an account tweets every minute about the same coin, that's a red flag.

Identifying Automated Behavior

High tweet rates, regular posting times, and copy-pasted content are signs of automated bots. Detecting these patterns is crucial to distinguishing between organic community discussions and orchestrated attempts to manipulate sentiment or price.

6. Cross-Referencing Twitter Data with Blockchain Activity

Event Correlation: Connecting Tweets with On-Chain Activity

Timing is everything. By correlating tweets with blockchain events—like significant transactions or token movements—you can uncover potential market manipulation. For instance, if there's a flood of tweets promoting a new coin right before a large transaction, it might suggest a pump-and-dump scheme.

Twitter Mentions and Market Movements

Tools like LunarCrush and Santiment offer a unique perspective by analyzing Twitter mentions and their correlation with market movements. This helps identify social sentiment patterns tied to actual trading behavior, providing leads on whether online hype matches on-chain activity.

7. Deep Profiling of Accounts and Activities

Analyzing Account Histories

Scrutinize an account's timeline. A newly created account that becomes hyperactive during a crypto pump or dump is a red flag. Evaluate the tweet frequency, content types, and engagement levels to discern if the account is legitimate or potentially part of a coordinated scheme.

Scrutiny of Bio and Metadata

Often, an account’s bio can provide clues to its credibility. Examine profile pictures, listed websites, and descriptions. Cross-referencing these details with other social media platforms or crypto forums can uncover connections to shady projects or fraudulent domains.

8. Advanced Search Techniques and Using the Twitter API

Utilizing Advanced Search Strings

Twitter’s advanced search function can be your best friend. Use Boolean operators, date ranges, and location filters to refine your search. For example, searching for "Ethereum AND scam OR fraud" can bring up specific tweets that may reveal warning signs of fraudulent activity.

Leverage Twitter’s API for Data Collection

For deeper analysis, the Twitter API allows you to pull large datasets, including tweets, user timelines, and engagement metrics. This raw data is invaluable for trend analysis and for identifying clusters of suspicious activity over time.

9. Timeline Analysis for Disinformation and Pump-and-Dump Schemes

Tracking Disinformation Timelines

Understanding how a rumor or news spreads can reveal its original source. By tracking the first few accounts to tweet about a new coin or project, you might uncover insiders or promoters who stand to benefit from the information’s spread.

Analyzing Flash Events and Virality

Flash events, like viral tweets or rapid spread of news, are common in crypto scams. Investigate how quickly tweets gain engagement, the nature of replies, and retweet patterns to detect if it's an organic viral moment or an orchestrated campaign designed to pump a coin or spread false information.

10. Geolocation and Language Analysis

Language Patterns and Regional Trends

Understanding the language and region of tweets can offer insights into where certain scams or projects are concentrated. For instance, a spike in tweets about a new coin in a particular language may indicate a localized marketing push—or a targeted scam.

Time Zone and Posting Behavior

Look at the time zones and posting patterns of accounts discussing specific cryptocurrencies. Are tweets clustered around specific exchange opening times? This could indicate coordinated attempts to manipulate markets based on global trading schedules.

11. Scraping for Suspicious Links and Content

URL and Link Analysis

Many crypto scams involve malicious URLs. By scraping tweets for shared links and using services like VirusTotal to analyze them, you can quickly identify phishing domains or fake websites used in fraudulent schemes.

Content Pattern Recognition

Scraping tweet text to find recurring phrases or media can reveal scam promotions. For instance, frequently posted images of “giveaways” or airdrops are often tied to fraudulent schemes. Identify these patterns to stay ahead of the scam.

12. Engagement Analysis to Detect Fraudulent Interactions

Spotting Unusual Engagement Patterns

If a tweet has unusually high likes, comments, or retweets compared to the account's follower count, this may indicate artificial boosting. Such tactics are often used to make content appear more popular and trustworthy, a common tactic in pump-and-dump schemes.

Reply Monitoring for Scams

Watch out for scams hiding in plain sight: in the replies to influential tweets. Fake support accounts, fake giveaways, or phishing links are often posted as replies. Monitor these threads for patterns of fake accounts or repeated scam tactics.

Conclusion

Twitter is a double-edged sword in the cryptocurrency space: a hub for real-time, authentic discussions as well as a playground for scammers and manipulators. By leveraging these investigative techniques—tracking hashtags, monitoring influencers, analyzing sentiment, and more—you can uncover hidden patterns, detect fraudulent schemes, and gather valuable evidence to enhance your crypto investigation. Twitter isn’t just noise—it’s a gold mine for insightful leads if you know how to dig properly.

Investigating Cryptocurrency on Telegram

In the evolving digital landscape, Telegram has emerged as both a communication hub and a hotspot for cryptocurrency activity. From discussions around trading tips to potential scams, Telegram's combination of anonymity and robust privacy features makes it a challenging yet invaluable platform for OSINT investigations.

This guide delves into how you can effectively investigate cryptocurrency activity on Telegram, offering best practices, techniques for uncovering user identities, and free tools tailored for the task.

Why Telegram Attracts Cryptocurrency Activity

Telegram's rise to over 700 million active users as of 2022 is driven by three key features that align perfectly with the needs of the cryptocurrency community:

Privacy and Anonymity: Telegram users can maintain privacy through aliases and selective disclosure of personal information, fostering the anonymity desired in many crypto discussions.

Flexible Moderation: The platform’s permissive moderation allows for an array of discussions, from legitimate investment strategies to dubious schemes and scams.

Rich Content Sharing: Users can easily share text, videos, documents, and more, providing versatile means to exchange information, tips, and even suspicious links to crypto wallets or exchanges.

However, these features also make Telegram a prime location for suspicious crypto-related activity, necessitating careful OSINT-based investigation techniques.

Challenges of Crypto Investigations on Telegram

Telegram's privacy-centric design makes it a complex environment for investigators to navigate. Here are some of the challenges you'll encounter:

End-to-End Encryption and Privacy: Secret chats are encrypted, making their content inaccessible to outsiders.

Alias-Driven Anonymity: Telegram users can hide behind usernames and phone number privacy settings, making it difficult to link profiles to real-world identities.

Verification Challenges: The spread of unverified crypto tips and fake listings in public groups requires careful validation across multiple sources.

Limited Access to Private Channels: Many cryptocurrency-focused groups are private, requiring invitation links or approval, creating access barriers for OSINT investigations.

Despite these barriers, there's still a wealth of information available for those who know where to look.

Best Practices for Conducting Crypto OSINT on Telegram

Cross-Reference Information: Validate all information gathered on Telegram by checking against other sources to ensure accuracy and to avoid misinformation.

Protect Your Identity: Use a VPN, anonymous accounts, and secure browsing tools to keep your investigative activities private.

Stay Ethical and Legal: Follow legal guidelines and Telegram’s terms of service. Ethical investigations ensure respect for privacy and compliance with local regulations.

Five Key Techniques for Crypto Investigations on Telegram

1. Search for Cryptocurrency Aliases

Start by searching for a Telegram username related to crypto activity. Users often recycle aliases across platforms, allowing you to find their presence on crypto forums, trading platforms, or other social media sites.

Example: An alias like "CryptoKing123" could be cross-searched on Twitter, GitHub, and crypto discussion forums to uncover linked accounts or crypto trading activity.

2. Search by Phone Number

Some Telegram users may have their phone numbers visible. Use this as a starting point to cross-check other platforms where that number might be tied to exchanges, wallet registrations, or other crypto services.

Example: A public phone number could be linked to P2P trading platforms, allowing you to extract additional details about trading behavior, associated wallets, or regional preferences.

3. Analyze Shared Crypto Wallet Links

In public crypto groups, users often share wallet addresses, exchange links, or transaction hashes. Analyzing these links can reveal wallet activity, transactions, and potential connections to other Telegram users or external platforms.

Example: By extracting all shared links from a group and analyzing the blockchain transactions tied to the shared wallet addresses, you can uncover the flow of funds and possibly track the source of cryptocurrency.

4. Reverse Image Search Profile Pictures

Profile pictures are often reused across platforms. A reverse image search of a user's profile picture can expose social media profiles, personal blogs, or other websites where the image is used, revealing connections to crypto trading or discussions.

Example: A photo of a user holding up a crypto-related T-shirt could be found on their LinkedIn or Facebook, providing insights into their offline presence and crypto affiliations.

5. Monitor Public Crypto Group Discussions

Public crypto groups often discuss ongoing events, new coin launches, or trading strategies. Analyzing the content of these discussions can help trace patterns, behaviors, and even real-world identities behind cryptocurrency transactions.

Example: Analyzing messages over time can reveal a pattern of crypto drops or giveaways, allowing investigators to identify potential scammers or pump-and-dump schemes.

Free OSINT Tools for Investigating Crypto on Telegram

Telegram Database: telegramdb.org – A search engine for public channels, groups, and bots. Useful for locating crypto-related communities.

Lyzem: lyzem.com – A specialized Telegram search engine to find discussions around cryptocurrency topics or key phrases.

Tlgrm.eu/channels: tlgrm.eu/channels – An indexed directory of public Telegram channels, making it easy to locate crypto-focused groups.

Tgstat: tgstat.com – A Telegram analytics tool providing insights into public groups and channels with crypto discussions.

IntelX.io Telegram Search: intelx.io/tools?tab=telegram – Advanced search across publicly available Telegram data, helpful for identifying crypto-related content.

metadata2go.com: metadata2go.com – Extracts metadata from images and videos shared in Telegram crypto groups, offering deeper insights into file origins.

Archive.org Telegram Archive: archive.org/details/archiveteam_telegram – A repository of archived Telegram data, allowing access to historical crypto-related discussions.

Case Study: Crypto Threat Monitoring with Telegram

A prime example of real-time crypto monitoring on Telegram is Hozint, which uses the platform to track crypto trends and threats. By analyzing groups focused on new coins, ICOs, and market changes, Hozint gathers intelligence to geocode and contextualize the data, demonstrating how Telegram can serve as a rich source for both immediate and long-term crypto insights.

Conclusion

Telegram is a powerful platform for crypto-related OSINT investigations when approached with the right techniques and tools. From alias tracing and phone number cross-checks to deep dives into shared links and public messages, Telegram holds valuable information for the discerning investigator. By leveraging the free tools available and respecting privacy and legal guidelines, you'll be well-equipped to uncover critical insights into the world of cryptocurrency on Telegram.

Leveraging GitHub for OSINT in Cryptocurrency Investigations

When conducting cryptocurrency investigations, uncovering a person’s GitHub profile can provide a rich source of open-source intelligence (OSINT). A well-maintained GitHub account is more than just a list of repositories; it’s a window into someone's technical skills, interests, connections, and potentially even vulnerabilities. Here's how to dig deeper and extract actionable information from a GitHub profile:

Understanding Technical Skills and Specialization

Every developer leaves traces of their skills on GitHub. By examining the repositories they've created or contributed to, you can pinpoint their go-to programming languages—like Python, JavaScript, or Solidity (a common language for smart contracts). Their repository topics can also highlight their areas of focus, such as blockchain, decentralized finance (DeFi), or Web3 development. Pay attention to tools, frameworks, and libraries they frequently use. A developer with a history of working on React and Django projects, for instance, might indicate web development expertise, while frequent use of blockchain-specific libraries like Web3.js shows a clear inclination toward cryptocurrency-related tech.

Mapping Project Involvement and Contributions

Reviewing someone’s public repositories provides insights into the kinds of projects they’re working on—whether personal, collaborative, or affiliated with an employer. The contribution graph on GitHub is another useful feature, displaying the frequency and consistency of their commits. A high level of activity could signal dedication to a particular project or a heavy involvement in coding during certain periods. Also, examining who else is contributing to those repositories helps you identify potential collaborators, teammates, or organizations they’re associated with.

Building Social Connections and Networks

GitHub isn’t just for code; it’s a social network for developers. Investigating the people they follow or who follow them can reveal ties to colleagues, tech influencers, or crypto communities. The repositories they’ve starred often represent areas they’re interested in learning more about or technologies they aspire to work with. Memberships in GitHub organizations can also clue you in on affiliations with companies, open-source projects, or coding communities, providing further context to their professional background and interests.

Extracting Personal Information and Digital Footprints

Many GitHub profiles include more than just usernames. A complete profile may contain the person’s real name, location, and even an email address or link to a personal blog. This can open up opportunities for cross-referencing with other platforms like LinkedIn or Twitter, where further OSINT data might be available. Pay attention to bio descriptions; sometimes, users share their professional role, company, or tech passion, which can be relevant in building a more complete profile.

Analyzing Code and Repositories

One of the most telling parts of a GitHub profile is the code itself. Looking through their public repositories reveals their coding style, structure, and even adherence to best practices. You’ll get a sense of how detailed they are with comments, documentation, and version control. Be sure to review configuration files like package.json (for Node.js) or requirements.txt (for Python), as these list dependencies and tools in their tech stack.

In some cases, sensitive information is accidentally exposed in these repositories—an investigator's goldmine. Look out for API keys, database connection strings, or even cryptocurrency wallet addresses that have been mistakenly committed to the repository.

Reviewing Commit History and Patterns

An individual’s commit history is more than a timeline of code changes; it can indicate work habits, time zones, and availability. Consistent patterns in commit times might show regular coding sessions or late-night activity. Commit messages are another valuable source—they often contain detailed explanations for changes, revealing workflows, task priorities, and collaboration skills.

Participation in pull requests and issues gives insight into how the individual interacts with others in the coding community. Are they active contributors to major projects, problem-solvers who help others debug issues, or maintainers who manage large codebases?

Identifying Interests and Learning Goals

The topics tagged on a user’s repositories often reflect their focus areas and interests, which can be valuable in an investigation. Regular contributions to projects tagged with "blockchain," "smart-contracts," or "cryptography" may indicate specialization in those areas. Forked repositories—copies of other users’ code—are also worth exploring, as they hint at technologies the user is currently exploring or plans to integrate into their work.

Evaluating Security Practices and Exposed Vulnerabilities

A user’s approach to security in their code tells you a lot about their awareness and dedication to best practices. Check for evidence of solid security measures, such as well-documented policies, secure handling of sensitive information, and proper dependency management. On the other hand, exposed secrets or credentials in public repositories can present significant security risks if left unnoticed, offering an opportunity to identify possible weak points.

Tracing Historical Activity and Evolution

People evolve over time, and so do their GitHub accounts. Archived repositories or older projects can show how an individual's skills, interests, and focus areas have changed. GitHub’s event timeline provides a play-by-play of their activity, such as forking repositories, creating issues, and engaging with other users, which helps you track their progress and growth in real time.

Identifying Professional Affiliations and Open Source Contributions

Analyzing a person’s contributions to open-source communities is an excellent way to understand their place in the wider tech ecosystem. It can reveal which communities or projects they’re committed to, hinting at specific interests, technologies, or even social causes. Work on public company-related projects can also suggest current employment or freelance work.

Building a Comprehensive Profile

By leveraging all the data points from a GitHub profile, investigators can piece together a detailed view of a person’s technical skills, networks, affiliations, and even security practices. This type of OSINT can provide a treasure trove of insights when conducting cryptocurrency investigations, offering leads to their involvement in blockchain technology, coding habits, or even mistakes that might expose sensitive information. Each insight builds a broader picture, helping you understand who they are, what they do, and how they operate in the crypto space.

Email OSINT

An email address is far more than a way to reach out; it's a potential goldmine of information. While we all know what’s in a name or Social Security number, what secrets does an email address hold? Surprisingly, an email address can reveal a wealth of publicly available data, all accessible through Open-Source Intelligence (OSINT). This chapter will take you through the techniques to unlock that information, often buried in the shadows of the “Deep Web”—the areas of the internet that search engines can't touch.

Let’s dive into these investigative methods:

Prospect-Seeking Websites

Sites like apollo.io, aihitdata.com, contactout.com, and rocketreach.co are built to help recruiters and sales professionals track down potential candidates and leads. But they also contain a wealth of information on professionals, including employment history and contact details. Searching for an email address on these platforms—or cross-referencing it with known details about the target—can quickly yield useful background information.

People Search Engines

Platforms such as thatsthem.com, searchpeoplefree.com, and truepeoplesearch.com allow you to enter an email address and discover other contact details like phone numbers, addresses, and even possible familial ties. These connections can provide context on the email owner, revealing links to cohabitants or past residences. Digging into these associations can help paint a broader picture of the person behind the email.

Data Breach Websites (DBWs)

In an era of widespread data leaks, breach databases like haveibeenpwned.com, leaklookup.com, and dehashed.com are powerful tools. They can tell you whether an email has been compromised in any known data breaches, and sometimes offer additional data tied to online accounts. This might range from username information to password hints, giving a glimpse into the target’s online activities and security vulnerabilities.

Email Verification Services

To confirm if an email address is active and valid, use services like verifalia.com or zerobounce.net. These platforms also allow you to explore other email addresses that have similar usernames but differ by domain (for instance, the same user might have both a Gmail and Yahoo account). This is particularly helpful for uncovering additional accounts or aliases linked to the individual.

Email Profilers

Tools like emailrep.io and synapsint.com can provide a deeper history of an email address, revealing the age of the account, any connections to social media platforms like LinkedIn or X (formerly Twitter), and more. They also perform MX (Mail Exchange) Lookups to confirm whether an email domain’s server is configured to send and receive messages, which can be an important detail in your investigation.

IntelTechniques Tool

If you're looking for an all-in-one solution, inteltechniques.com/tools/Email.html offers an aggregation of data from various OSINT sites. This tool pulls together multiple resources to give you a comprehensive overview of the email address in question, speeding up your research process.

Epieos

Another powerful option is epieos.com, which allows for reverse email lookups. With this service, you can find out if an email is linked to specific online platforms like Google or Skype and see which websites it’s been used on for account registrations. It's a versatile tool for confirming where and how an email address is being used online.

Putting it All Together

By leveraging these tools and techniques, an email address becomes more than just a contact—it’s a pathway into an individual's digital life. Whether you’re tracing background information, online behaviors, or connections to other individuals, understanding how to research email addresses is a critical skill for any investigator.

Email addresses offer a gateway into a person's world, and learning to navigate that gateway effectively can open doors to untapped information. As we delve into this digital landscape, it's crucial to use these techniques ethically, ensuring that our investigations remain precise, informed, and responsible—one email address at a time.

Investigating Cryptocurrency Using Username Search Tools: A Step-by-Step Guide

In cryptocurrency investigations, usernames are a crucial piece of the puzzle. Often, users involved in crypto activities reuse their usernames across multiple platforms. By uncovering these profiles, you can find connections, affiliations, or even personal information that can aid your investigation. Below is a list of key username search tools, followed by guidance on how to leverage them effectively for cryptocurrency-related cases.

Key Username Search Tools

1. IntelTechniques Username Search

URL: https://inteltechniques.com/tools/Username.html

2. WhatsMyName

URL: https://whatsmyname.app

3. UserSearch

URL: https://usersearch.org

4. Namechk

URL: https://namechk.com

5. UserHunt

URL: https://userhunt.co

6. InstantUsername

URL: https://instantusername.com

7. CheckUsernames

URL: https://checkusernames.com

8. Blackbird OSINT

URL: https://blackbird-osint.herokuapp.com/

Investigative Guidance for Using Username Searches

• Cross-Platform Identification: Start by searching for a cryptocurrency-related username tied to a wallet or exchange account. Use the tools to identify if this username is reused across platforms, which can reveal additional accounts that might include forums, social media, or even gaming sites. These profiles could hold clues about the user’s interests, connections, or other personal identifiers.

• Correlating with Crypto Wallets: Often, crypto users interact on various platforms discussing trades, projects, or even scams. If you can identify a user with a history of crypto-related discussions, you can start correlating their username with wallet addresses, crypto platforms, or specific transactions mentioned in posts.

• Tracking Activity Patterns: Once you find multiple accounts with the same username, examine their activity to uncover patterns, such as discussions about specific cryptocurrencies, mention of exchanges, or even time zones reflected in posting habits. This can give hints about the user’s location, financial habits, or potential involvement in illicit activities.

• Tying to Real-World Identities: In many cases, crypto users may unintentionally connect their digital usernames to real-world information. For example, a user might list their email address, link to a personal blog, or even use the same username on LinkedIn or other platforms that reveal their true identity. By carefully combing through these connections, you can begin to build a profile that ties digital activity to a real person.

• Watching for Deleted or Changed Usernames: If you suspect that a user has deleted their account or changed usernames to evade detection, using tools like Reveddit or ReSavr (as mentioned in the Reddit chapter) can be crucial for retrieving historical data. Username changes are often an attempt to cover up activity, but the right tools can uncover what’s been hidden.

By using these username search tools strategically, you can peel back layers of anonymity and uncover the real-world individuals behind cryptocurrency activities. Each username search is a step closer to understanding the motivations, patterns, and behaviors that drive crypto transactions and related discussions.

For international investigations this is the ONLY tool i’ve ever seen for finding the all important public records in other countries.

Phonebooks, cadastral maps, vehicle numbers databases, business registries, passengers lists, court records and much more.

https://well-known.dev/

How to Use the Well-Known OSINT Tool

What It Does

The Well-Known OSINT tool helps you discover information about a website by scanning its .well-known resources. These resources contain structured metadata that websites use to share important information about security policies, ad authorization, app associations, and more.

How to Use It

1. Submit a Site for Scanning

• Enter the URL of the site you want to investigate.

• If the site has already been scanned, you can view the existing results.

• If not, the tool will analyze its .well-known directory.

2. Review the Results

The scan will return details about the following .well-known resources (if available):

• Ads Authorization

• /ads.txt – Lists authorized ad sellers.

• /app-ads.txt – Similar but for mobile apps.

• App & Site Associations

• /apple-app-site-association – Defines relationships with Apple apps.

• /assetlinks.json – Defines relationships with Android apps and websites.

• Privacy & Security

• /gpc.json – Indicates if the site respects Global Privacy Control.

• /security.txt – Provides security policies and contact info.

• /robots.txt – Specifies crawling rules for web crawlers.

• Authentication & Federation

• /openid-configuration – Contains OpenID Connect provider metadata.

• Distributed Networks & Trust

• /nodeinfo – Provides metadata about decentralized social networks.

• /trust.txt – Declares relationships with other publishers.

Use of the Information

The data obtained from .well-known resources can be applied in various investigative contexts:

• Fraud Detection → Identifies unauthorized ad sellers or fake app associations.

• Privacy & Compliance Audits → Verifies if a website respects privacy standards like GDPR and CCPA.

• Cybersecurity Research → Finds security contacts, policies, and crawling restrictions.

• Threat Intelligence → Maps out connections between sites, apps, and authentication providers.

• Brand & Reputation Analysis → Confirms legitimate affiliations and detects impersonation risks.

This information helps researchers, security professionals, and analysts assess a website’s transparency, security posture, and digital trustworthiness.

That’s it!

Nonfungible.com (nonfungible.com) is an NFT database that enables investigators to track and analyze digital asset transactions. Search by entering a collection name, and you’ll receive sales data and transaction history related to the collection.

Zapper.fi (zapper.fi) is a DeFi asset management platform that allows users to swap digital assets and track their DeFi portfolios. You can search for a wallet address to see its portfolio, including NFTs, and view transaction history categorized by asset type.

Rarible.com (rarible.com) is another NFT marketplace. You can search for NFTs by collection name, username, or NFT name, and access transaction history for each NFT.

These tools provide comprehensive insights into Ethereum addresses, smart contracts, and NFTs, helping you track ownership, identify connections, and understand how assets move across the blockchain

Let's walk through how to investigate people through NFTs by starting at Rarible.com, one of the most popular NFT marketplaces.

1) Start by going to the main page of https://rarible.com

2.) There is a lot of information here, much of it we do not care about. So click on the “Explore” tab and it brings up the page below will several options of where to go from here.

3) Depending on your investigation you can choose to look up listings of NFTs, NFT owners/creators, Marketplaces, and NFT Collections. Let’s explore what kind of information you can find by clicking on the different tabs.

4.) Below is the Collections page (https://rarible.com/explore/all/collections)

Exploring Collections offers a window into the person’s artistic and investment interests. This section can reveal what types of digital assets the individual values and might indicate a pattern in their collecting behavior or connections to specific artists or projects. Understanding the collections that a person engages with can shed light on their aesthetic preferences or strategic choices in the NFT sphere.

5.) Here is the Marketplaces tab (https://rarible.com/explore/all/marketplaces)

Investigating the Marketplaces where the person is active can uncover which platforms they prefer and provide detailed data on their transaction history, including purchases, sales, and trades. This information is crucial for tracking their activities across different blockchain ecosystems and understanding market trends such as floor prices and sales volumes.

6.) The NFTs tab (https://rarible.com/explore/all/items)

Looking at specific NFTs owned or traded by the person can reveal the rarity, traits, and potential value of these items, which helps in analyzing the composition and overall value of their portfolio. Additionally, it may uncover connections to other users through shared ownership or transaction history, providing clues about their network.

7.) NFT owners and creators (https://rarible.com/explore/all/users)

Finally, examining the Users section can lead to an understanding of the person’s social interactions within the NFT community. It can help identify potential collaborators, business partners, or even suspicious associations. This section also provides context for the person’s role within the NFT ecosystem, whether as a collector, creator, or trader, and allows for comparisons with other users’ behaviors and transaction patterns.

By integrating insights from these four aspects, an investigator can construct a detailed profile of the person's NFT-related activities, encompassing their financial behavior, social connections, investment strategies, and potential involvement in suspicious activities. This holistic approach enables the identification of patterns, anomalies, or trends that might remain hidden when analyzing each aspect separately. The investigation draws on resources and methodologies discussed in various analytical and investigative reports on NFTs, providing a thorough groundwork for understanding and tracking NFT engagements.

Let’s dive deeper into investigating an NFT owner.

8.) If we want to learn about an NFT user we can click on one of the listings from the NFT users page to bring up a new page specifically on the user.

(https://rarible.com/user/0xdda5294a93b1eb1ed840f9ae7843e325c573cbaf/owned)

Note that alternatively, your investigation might start with already knowing the NFT owner’s crypto address. This is a common occurrence when investigating crypto transactions on a scanner like Etherscan. So if your investigation does bring you to an NFT owner’s crypto address, you can simply take the address to Rarible to look up the user's account. To do so, I recommend that you do not use the search function on the Rarible homepage. Instead go to the Rarible NFT owners and creators (https://rarible.com/explore/all/users) and use this search function to search the address.

Regardless of how you find the user on Rarible, when you click on their account you see a typical profile page that is reminiscent of social media accounts. Such as the short bio written by the account owner and the number of followers, and following.

Most notably there is also the account owner's crypto address. If you click on the dropdown next to the address you see the account owner's addresses for different blockchains where they are present.

This is great for many reasons but lets us focus on one for now. Using the address you can look up the cryptocurrency wallet in a blockchain explorer like Etherscan.

For example, looking up this user’s address in Etherscan brings up the following details page.

NFT Usage - Investigative Guidance

If you are investigating someone and discover they are an NFT owner, you can learn a lot by researching their NFT usage. You can delve into their transaction history to uncover insights into their financial behavior and interests. By examining the buying, selling, and trading activities, you can decode their engagement patterns.

Identifying the blockchain wallet addresses used in these transactions is key to tracking their activities across different platforms, which might also reveal connections to other accounts.

Studying the types of NFTs a person collects or creates can provide a window into their interests, artistic leanings, or investment tactics. The platforms and marketplaces they frequent are equally telling, indicating their preferred ecosystems and potential for further account discoveries. Social connections are crucial; interactions with other NFT users, artists, or collectors can reveal networks and collaborations.

If the person is an NFT creator, analyzing their minting activity—including frequency, pricing, and themes—can offer insights into their creative and commercial approach. Be vigilant for unusual transaction patterns that might suggest illicit activities, such as money laundering, especially if there are frequent high-value trades with the same counterparts or use of mixing services like Tornado Cash.

Cross-platform analysis can give a more comprehensive view of the person’s behavior by comparing NFT activities across different blockchains and marketplaces. The metadata associated with NFTs they interact with is also a rich source of information, potentially containing details beyond the visible transactions. Time-based analysis can help identify patterns or correlations with other events, adding a temporal dimension to the profile.

Lastly, assessing the financial value of the person’s NFT portfolio and transactions can shed light on their investment capacity and strategy. Utilizing blockchain analytics tools is essential in these investigations, and it’s crucial to adhere to legal and ethical guidelines. While blockchain transactions are generally public, linking them to real-world identities requires careful consideration and compliance with applicable laws and regulations.

NFT Anonymous Owner - Investigative Guidance

Uncovering the identity of an anonymous NFT owner can be challenging, given the inherent privacy of blockchain technology. However, there are several investigative methods available that can help you trace clues and identify patterns—all from the comfort of your computer, using publicly available tools. Here’s a focused guide on how to investigate and potentially figure out the anonymous owner of an NFT.

Blockchain Transactions

Look for transaction patterns that could suggest frequent interactions with specific wallets or exchanges to identify where the funds are going. Follow any token transfers from the anonymous wallet. By tracing where the tokens are sent, you may find connections to wallets that are linked to identifiable exchanges or services.

Look for Identifiers

If the wallet uses an ENS (Ethereum Name Service) domain, it could provide more insight into the owner’s identity. ENS domains are often linked to public profiles, websites, or other information that might give clues about the user.

Pay attention to the metadata associated with the NFT. Metadata may include additional information, such as descriptions or references, that could point you in the direction of the owner. In some cases, creators leave personal details or hints in the metadata, which could help reveal their identity.

Social Media and Online Presence

NFT ownership is often associated with social media and other avenues to display or discuss NFTs. There are often groups or places specifically focused on specific NFT types. Many NFT owners actively engage on platforms like Twitter, Reddit, or Discord, where they discuss their collections, blockchain activities, or even promote their own NFTs.

NFT Investigation - authenticity, provenance, and legitimacy

Building on the earlier discussion about NFTs and the tools used to examine them, let’s dive deeper into how to thoroughly investigate these digital assets. Understanding an NFT's authenticity, provenance, and legitimacy requires attention to a few key areas, many of which we’ve already touched on, such as tracking metadata and verifying creators. Here, we’ll go step by step into the investigative methods you can use with just your computer and an internet connection.

Checking Metadata

We’ve already seen how metadata plays a crucial role in identifying an NFT’s details. This includes creation dates, the creator’s information, and any associated files like images or videos. To access metadata, you can use NFT marketplaces or blockchain explorers such as Etherscan (for Ethereum) or Blockchair. These tools will allow you to view the NFT’s history and associated data. Ensuring the content matches the description is critical, as any discrepancies might indicate a fraudulent asset.

Verifying the Creator

It's essential to know who created the NFT, as this speaks to its authenticity and value. First, examine the creator's profile on NFT platforms like OpenSea or Rarible. Free platforms like these often verify well-known creators, offering badges and social media links that confirm their identity. Don’t just rely on the marketplace—search their reputation across platforms like Twitter or Reddit, and look for their previous work to ensure they’re a legitimate artist or developer.

Reviewing Transaction History

Just like with any other cryptocurrency asset, reviewing the transaction history of an NFT is an important step in your investigation. You can use Etherscan or BscScan for this purpose. These tools will show every transaction associated with the NFT, allowing you to track ownership changes, sale prices, and dates of transfers. Be on the lookout for irregularities, such as a sudden spike in transactions or large, unexplained movements of the asset. Such anomalies might be a red flag for wash trading or market manipulation.

Smart Contract Analysis

The underlying smart contract is what enforces the terms of the NFT and its associated assets. Analyzing the contract is crucial for confirming its legitimacy. On free platforms like Etherscan, you can access the smart contract’s source code and check if it follows standard practices. This can help ensure that the NFT is built on a secure and trustworthy contract. Also, make sure the contract address matches the one listed on the marketplace where the NFT is being sold, as discrepancies might suggest fraudulent activity.

Examining the Marketplace

Not all NFT marketplaces are created equal, and it's important to consider the reputation of the platform hosting the NFT. Well-established platforms like OpenSea or Rarible have certain measures in place to verify creators and their work. Look for verification badges that confirm the NFT’s authenticity. Additionally, ensure the platform itself is reputable and widely used. This gives you confidence that the NFT has passed basic checks before being listed.

Community Feedback

Checking community sentiment is another useful step in your investigation. Platforms like Reddit or Discord have dedicated NFT communities where users discuss ongoing projects and the credibility of creators. These forums often provide unfiltered insights from other collectors and buyers who have interacted with the NFT. Reviews, feedback, and testimonials from users who’ve dealt with the creator can give you a good sense of whether the NFT is legitimate or something to be cautious about.

Reverse Image Search

When it comes to digital art NFTs, one of the quickest ways to verify originality is by running a reverse image search. Tools like Google Reverse Image Search or TinEye are free and effective. By uploading the NFT’s associated image, you can see if it has been used elsewhere on the internet. If the image has been copied from another source or isn’t unique, this could indicate that the NFT is a rip-off or fraudulent copy.

Using Analytical Tools

To take your investigation a step further, free NFT analytics platforms can provide deeper insights into the asset's market performance. Sites like NonFungible.com and DappRadar allow you to track an NFT’s sales volume, ownership history, and market trends. This information can help you gauge whether the NFT’s value is rising, how active the market is, and whether there are red flags like sudden price spikes or erratic sales patterns.

Tools for Investigating NFTs

Etherscan.io – A blockchain explorer for Ethereum, used for checking transaction history, metadata, and smart contract details.

OpenSea.io – The largest NFT marketplace where you can verify creators, track listings, and view transaction details.

Rarible.com – Another popular NFT marketplace with tools for creator verification and transaction tracking.

Google Reverse Image Search – A tool for checking the originality of digital art by searching where the image has appeared online.

NonFungible.com – An analytics platform offering insights into NFT performance, ownership history, and market trends.

DappRadar.com – A tool that tracks decentralized apps (dApps) and NFTs, providing detailed information about market activity and trends.

TinEye.com – Another reverse image search tool to verify the uniqueness of digital art NFTs.

Summary of Walkthrough

1. Lookup Quirkies on Etherscan

   • Search for "Quirkies" on Etherscan.

   • Look it up on Google.

   • Find the official website.

   • Scroll to the bottom of the website to locate community links.

2. Owner Information

   • Owner Address: 0x315014d50459D218D3294a888897Ca12B6ce694b

   • Lookup the domain name associated with the address.

   • Search for other names linked to it.

3. Identifying Social Media Accounts

   • Google the username "bullishonquirks" to find the Twitter account.

   • Open their Twitter posts.

   • Perform a reverse Google image search on this image: Twitter Image

   • Compare visual matches vs. "About this image" insights.

Investigating an Anonymous Crypto Wallet Owner

If you discover a crypto wallet or social media account revealing NFT ownership but do not know the owner, follow these steps:

1. Check Blockchain Information

   • The NFT’s blockchain info is in the URL:

     • Rarible NFT Link

     • OpenSea NFT Link

   • Token Contract: 0x0baeccd651cf4692a8790bcc4f606e79bf7a3b1c

   • Token Number: 15639

2. Understanding NFT Wallet Addresses

   • NFTs do not have a specific wallet address.

   • Instead, each NFT belongs to a token contract that groups NFTs together.

   • Each NFT has a unique Token ID within the contract.

   • NFTs typically have a metadata URL: NFT Image

3. Researching NFT Owners

   • Go to an NFT marketplace like Rarible.com.

   • Identify potential owners by:

     • Checking interactions and trading history.

     • Exploring the NFT collection.

   • Search for linked social media accounts in their profile bios.

   • Look for community links on Discord and Telegram.

   • Compare data from multiple NFT marketplaces like Rarible and OpenSea.

Marketplace Activity and Metadata Analysis

1. Rarible Marketplace Insights

   • Displays blockchain activity: purchases, sales, bids, auctions.

   • Lists the type of token and its blockchain.

   • The description section includes links to blockchain scanners and other marketplaces like OpenSea.

2. OpenSea Metadata Analysis

   • OpenSea profile pages provide detailed information.

   • In the "Details" section, next to "Token ID," the Token ID number is a hyperlink to the NFT metadata file:

     • Metadata File

   • Download and open the metadata file in a text editor:

{

"name": "Pepe #15639",

"description": "The Peplicator!\nhttps://www.peplicator.fun/\nBy Matt Furie\nThe first generative NFT collection from the creator of Pepe The Frog\nEach NFT an original 1/1 Pepe\nBrought to you by Chain/Saw\nhttps://www.chainsaw.fun/",

"image": "https://data.peplicator.fun/pepes/15639.png",

"attributes": [

{"trait_type": "Bg", "value": "Aqua"},

{"trait_type": "Frog", "value": "Happy frog"},

{"trait_type": "Stuff", "value": "Good doggy dog"},

{"trait_type": "Mouth", "value": "Chin folds"},

{"trait_type": "Hats", "value": "Folds"},

{"trait_type": "Facial", "value": "Pignose"}

]

}

Using Etherscan to Track NFTs

1. Find the Token Contract Address

   • Etherscan Token Contract

   • The contract manages NFT transactions but does not show individual token activity.

2. Use the Token Tracker Page

   • Etherscan Token Tracker

   • This page tracks activity for all tokens in the contract.

   • Includes links to social media accounts and community channels.

   • Etherscan Info on Token Tracking

By following these steps, you can gather crucial information about NFTs, their transactions, and potential ownership.

How to Identify an NFT from an Image

1. Get the Best Image Version

   • Right-click the NFT image and open it in a new tab for the highest quality.

2. Do an Image Search

   • Use Google Reverse Image Search, TinEye, or another tool.

   • The exact NFT may not show up, but look for the collection name.

3. Find the Collection on an NFT Marketplace

   • Go to OpenSea, Rarible, or another marketplace.

   • Search for the collection name you found.

4. Use Filters to Narrow It Down

   • On the collection page, use filters like background color, clothing, accessories, etc.

   • On Rarible, go to a collection’s page in the "Collections" section, then click on "Items," then "Filters," then "Properties."

5. Verify the Features

   • Some traits may not be obvious.

   • You can click on or hover over a feature to see what NFTs match it.

   • Compare and refine until you find the exact NFT.

6. Final Check

   • Once you’ve narrowed it down, double-check details like rarity and ID.

The types of information you can obtain about a person varies depending on the app. You will also need to sign up for a free account with most of these apps.

Some of these useful apps include Paypal, Cash.App, Venmo, Zelle, and Skype.

Here is a screenshot of the Paypal website. Here you choose to Send and Recived and then click Send. Next you need to choose who to send money to, and there is a search function under “Send money” where you input the person’s name, username, email, or mobile.

As you type in a name, a dropdown menu appears with several guesses based on what you’ve typed.

For Whatsapp, consider using Whapi.cloud

To search usernames specifically:
https://www.paypal.com/paypalme/username
https://cash.app/$username
https://account.venmo.com/u/username

That’s it!

The process for using this tool have become much simpler. Assuming you have github and gitpod accounts,

1 - you put this url into your browser : “gitpod.io/#https://github.com/megadose/holehe”

2 - wait and then click “new workspace”

3 - wait and when the the virtual computer is opened up, just type in “holehe” followed by the email address you want to investigate. For example “holehe fake@example.com”

4 - Hit “enter” and you are done!

We can identify a list of websites where a specific email address has registered accounts in a very straightforward process of 6 steps. This process does not require the reader to know, learn, or download Python, but does use a Python script.

CREDIT WHERE IT IS DUE:This process does not require a knowledge of Python but the explanation must address the computer language a bit. The Github user account Megadosehosts an amazing Python script named Holehe and deserves a lot of credit for this creation.

The script will find the different social media networks where the email is registered to an account. However, because many people do not know anything about Python, I’ve come up with a process intended for people that do not know anything about python and do not want to learn about it. It is a rote process requires no knowledge of python, no downloads, and no thinking at all.

Instructions for First Time Using Holehe

Step 1 (the hardest) – Click here and sign up for an account on Github . Sorry, that is more than one step but the process is simple and it gets easy afterward.

Step 2 – Login to Gitpod. You do not need to sign up for Gitpod if you already have a Github account. Go here (https://gitpod.io/login/) and you will see an option on the left to sign in with your Github account even though you don’t have a Gitpod account. See below:

Once you have logged in your page will probably look like this:

Step 3 – Copy and paste this url into your browser and hit Enter:

gitpod.io/#https://github.com/megadose/holehe

Why? – Basically, you are making a url that consists of the gitpod website url, a hashtage, and the url of the github page for the script.

Here is the explanation. We want to run a Python script but to do so we need a development environment. Normally you would download it but in this case, Gitpod provides a development environment online where you can run Python scripts. When you identify a script posted on Github you create a url of the Gitpod website’s url, a Hashtag, and the url for the page hosting the Python script. So with our script hosted at https://github.com/megadose/holehe, we create a url like this:

gitpod.io + /# + https://github.com/megadose/holehe

Gitpod will create a workspace, a virtual computer, specifically for running the script. The script and its affiliated files will be downloaded though you will likely still have to run the setup.py file, or its equivalent. If you go to the script’s page on Github there should be instructions for downloading and running the script.

Wait for Gitpod to do some processing and then your computer should look like this:

Step 4 – At the bottom of the screen find where it says “/workspace/holehe $”.

Click to the right of these words and type “python3 setup.py install” and then hit enter.

Step 5 – Wait for the install to complete and then right click on the folder on the type left that is named “holehe” (not the one titled “holehe.egg-info”). When you right click on the folder a drop down menu appears, choose “open in terminal”.

A new tab has appeared in the terminal, notice the new tab that reads “gitpod /workspace/holehe/holehe” and the cursor is located next to a similarly named prompt.

Step 6 – Finally, choose your email that you want to research, in our case we will use the fake example email “fake@example.com”

Now the last thing to do is type in the final sequence with your email in place of our fake example. So find the prompt “gitpod /workspace/holehe/holehe $” and next to it you will type the following and hit enter:

“holehe fake@example.com”

Results: Separately, I ran a real email address for an example to show how the results should look. The output is a list of 50 or so social media networks and other websites. If the name of the site/network is purple, there was no account on it, green means there is an account registered with the email address and red means the script could not check the site. Hopefully you got something like this:

Now that you’ve done this once, the process will be much easier in the future.

Next time

Login to Gitpod and there will be a workspace named for the script. It should look like the image below. Just click “Open” on the workspace.

From here, you repeat steps 4, 5, and 6. You install setup.py, open a new terminal tab, and run the command.

That’s it!