OSINT Investigator’s Toolkit - Full Tool Catalogue
reference
Contents
Jump to a section:
Blockchain · Infrastructure · Email OSINT · Username · Phone OSINT · Face Search · Image OSINT · Geolocation · Breach & Exposure · Threat Intel · Documents & Metadata · Social, Twitter/X · Social, Telegram · Social, Discord · Social, Reddit · Social, Instagram/TikTok · Social, Meta · Social, LinkedIn · Social, General · Darknet · Corporate & Records · Search & Dorking · Investigator Toolkit · Additional Tracing & Attribution Platforms · Cross-Chain Bridge Explorers · Bridge Resolution APIs · Instant-Swap / Instant-Exchange Services · Additional Infrastructure & Domain OSINT · Scam & Phishing Databases · Case Documentation · Freezing, Blacklisting & Recovery · Law Enforcement Liaison & Cross-Sector Coalitions · The three-piece investigator workflow (framing) · Bridge & cross-chain explorers / utilities · Tracing / case tooling · Email / domain OSINT · Corporate Registries by Country (Europe) · OSINT Handbooks, Guides & Curated Stacks · Self-hosted chain analysis (build your own graph) · Address risk, attribution & community reports · CoinJoin coordinator discovery · Event Signature & Selector Lookup · Privacy-Coin & CoinJoin Explorers · Court Records: United States · Court Records: UK & Ireland · Court Records: Europe · Court Records: Asia-Pacific & Commonwealth · Court Records: Africa, Latin America & Middle East · Court Records: Cross-Jurisdiction & Meta · Working a docket in a crypto case · Law-enforcement forensic platforms · VASP compliance and legal-request references · Chain-Native Block Explorers by Network · Official Reporting & Escalation Portals
A curated, field-tested directory of open-source intelligence tools for crypto forensics, digital investigations, and threat hunting. Catalogue version v2026.05; 170 tools across 23 categories (all entries verified 2026-05 unless a note says otherwise).
OPSEC legend: Safe = low exposure; Caution = the tool transmits/logs your query to a third party (source tag “OPSEC”); High = strong exposure (hostile-jurisdiction hosting, contact upload, face search, etc.). Tool inclusion is not endorsement; OPSEC tags are advisory, not guarantees; verify findings independently.
Blockchain (33 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Arkham Intelligence | Entity-based blockchain intelligence with wallet attribution, alerts, and visual fund-flow. | freemium | Intermediate | Caution | Passive | Web wallet tx | platform.arkhamintelligence.com | |
| MetaSleuth | Visual blockchain investigation tool for tracing cross-chain fund flows. | freemium | Intermediate | Caution | Passive | Web wallet tx | metasleuth.io | |
| Breadcrumbs | Graph-based transaction visualiser with clustering and tagging. | freemium | Intermediate | Caution | Passive | Web wallet tx | breadcrumbs.app | |
| Nansen | On-chain analytics with smart-money wallet labels across major chains. | paid | Advanced | Caution | Passive | Web wallet | nansen.ai | |
| MistTrack | AML & address risk scoring from SlowMist; designed for compliance and investigations. | paid | Intermediate | Caution | Passive | Web wallet tx | misttrack.io | |
| Chainalysis Reactor | Industry-standard enterprise blockchain investigation platform (LE/compliance). | enterprise | Enterprise | Caution | Passive | Web wallet tx | chainalysis.com | |
| TRM Labs | Enterprise crypto risk and investigations platform; growing LE adoption. | enterprise | Enterprise | Caution | Passive | Web wallet tx | trmlabs.com | |
| Elliptic Investigator | Enterprise blockchain analytics with strong UK/EU compliance footprint. | enterprise | Enterprise | Caution | Passive | Web wallet tx | elliptic.co | |
| GraphSense | Open-source blockchain analytics platform (Iknaio/AIT). Strong alternative to commercial tools. | free | Advanced | Safe | Passive | Self-host wallet tx | graphsense.info | |
| Bubblemaps | Visualises token holder clusters, essential for memecoin and rug investigations. | freemium | Beginner | Caution | Passive | Web wallet | bubblemaps.io | |
| Dune Analytics | SQL-based on-chain analytics platform with thousands of community dashboards. | freemium | Advanced | Caution | Passive | Web/SQL wallet tx | dune.com | |
| Lookonchain | Curated on-chain investigation feed (whales, exploits, suspicious flows). | free | Beginner | Safe | Passive | Web wallet | lookonchain.com | |
| Etherscan | Canonical Ethereum explorer; transactions, contracts, tokens, labels. | free | Beginner | Caution | Passive | Web wallet tx | etherscan.io | |
| Blockchair | Multi-chain explorer & search engine (BTC, ETH, BCH, LTC and more). | free | Beginner | Caution | Passive | Web wallet tx | blockchair.com | The only free explorer that indexes output scripts, so it can search OP_RETURN content: /bitcoin/outputs?q=script_hex(<full_script_hex>). Free tier blocks hard: API 430 is a throttled IP, web 403 is an outright edge block. Change egress or fall back to a raw-block sweep |
| OKLink Explorer | Multi-chain explorer with address tagging and tracing tools. | free | Beginner | Caution | Passive | Web wallet tx | oklink.com | |
| Solscan | Solana explorer and analytics dashboard. | free | Beginner | Caution | Passive | Web wallet tx | solscan.io | |
| Subscan (Polkadot) | Polkadot / Kusama / parachain explorer. | free | Beginner | Caution | Passive | Web wallet tx | subscan.io | |
| TronScan | TRON explorer; vital for USDT-TRC20 investigations. | free | Beginner | Caution | Passive | Web wallet tx | tronscan.org | |
| Mempool.space | Bitcoin mempool intelligence, fee analytics, and address explorer. | free | Intermediate | Safe | Passive | Web wallet tx | mempool.space | Free REST API, no key, generous limits. Three endpoints worth memorising: /api/block/<hash>/raw returns the whole block for byte-level searching (one request instead of ~100 paginated tx calls), /api/v1/mining/blocks/timestamp/<unix_ts> anchors a wall-clock time to a block height, /api/block-height/<n> maps height to hash. No content search, so pair it with Blockchair |
| Whale Alert | Tracks large on-chain transactions and exchange movements in real time. | free | Beginner | Safe | Passive | Web/Twitter wallet | whale-alert.io | |
| Bitquery | Comprehensive on-chain data API and explorer across many blockchains. | freemium | Advanced | Caution | Passive | API/Web wallet tx | bitquery.io | |
| DEXTools | Real-time DEX trading data, wallet tracking, and liquidity analysis. | freemium | Beginner | Caution | Passive | Web wallet | dextools.io | |
| Tenderly | Smart contract debugger and transaction simulator. | freemium | Advanced | Caution | Passive | Web wallet tx hash | tenderly.co | |
| BlockSec Phalcon | Transaction explorer with attack detection and post-exploit analysis. | free | Advanced | Caution | Passive | Web tx wallet | phalcon.blocksec.com | |
| GoPlus Security | Token & contract risk API/UI. Useful for fast scam screening. | freemium | Intermediate | Safe | Passive | API/Web wallet | gopluslabs.io | |
| Webacy | Wallet risk scoring and threat exposure analysis. | freemium | Beginner | Caution | Passive | Web wallet | webacy.com | |
| Chainabuse | Community scam/abuse reports across major chains. | free | Beginner | Safe | Passive | Web wallet | chainabuse.com | |
| ScamSniffer | Phishing & scam address tracker across multiple chains. | freemium | Intermediate | Caution | Passive | Web/Extension wallet domain | scamsniffer.io | |
| OFAC SDN Search | US Treasury Specially Designated Nationals list, sanctions screening (incl. crypto addresses). | free | Intermediate | Safe | Passive | Web wallet | sanctionssearch.ofac.treas.gov | |
| OpenSanctions | Aggregated sanctions, PEP, and watchlist data with crypto address coverage. | free | Intermediate | Safe | Passive | Web/API wallet | opensanctions.org | |
| Revoke.cash | Audit and revoke ERC-20/721 approvals. Defensive, use with caution post-incident. | free | Beginner | Caution | Active | Web wallet | revoke.cash | |
| Zapper | Portfolio and DeFi position visualiser; useful for mapping interactions. | freemium | Beginner | Caution | Passive | Web wallet | zapper.xyz | |
| Blockchain.com Explorer | BTC/ETH explorer for transactions and addresses. | free | Beginner | Caution | Passive | Web wallet tx | blockchain.com |
Infrastructure (20 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Shodan | Search engine for internet-connected devices; surfaces open ports, banners, services. | freemium | Intermediate | Caution | Passive | Web/API ip domain | shodan.io | |
| Censys | Internet-wide host and certificate search; mapping exposed assets. | freemium | Intermediate | Caution | Passive | Web/API ip domain hash | search.censys.io | |
| FOFA | Chinese internet asset search engine. Often surfaces assets Shodan/Censys miss. | freemium | Intermediate | High | Passive | Web ip domain | en.fofa.info | Hosted in China; OPSEC-sensitive. |
| ZoomEye | Alternative internet asset search engine. Complementary visibility to Shodan. | freemium | Intermediate | High | Passive | Web ip domain | zoomeye.org | Hosted in China; OPSEC-sensitive. |
| Criminal IP | Threat-scored IP/asset search engine with risk indicators. | freemium | Intermediate | Caution | Passive | Web/API ip domain | criminalip.io | |
| GreyNoise | Distinguishes targeted scans from internet background noise. SOC essential. | freemium | Intermediate | Safe | Passive | Web/API ip | greynoise.io | |
| urlscan.io | Sandboxed URL analysis: DOM, screenshot, requests, certs, ASN. Critical tool. | freemium | Beginner | Caution | Passive | Web/API domain | urlscan.io | Public scans are visible to others, use private mode for sensitive cases. |
| crt.sh | Certificate transparency log search; subdomain enumeration goldmine. | free | Intermediate | Safe | Passive | Web domain | crt.sh | |
| SecurityTrails | Historical DNS, subdomains, WHOIS, gold standard for infrastructure pivoting. | freemium | Intermediate | Safe | Passive | Web/API domain ip | securitytrails.com | |
| DNSDumpster | Passive DNS recon for subdomain discovery and infrastructure mapping. | free | Beginner | Safe | Passive | Web domain | dnsdumpster.com | |
| ViewDNS.info | Multi-tool DNS suite: reverse IP, DNS history, port checks, propagation. | freemium | Beginner | Caution | Passive | Web domain ip | viewdns.info | |
| IPinfo | IP geolocation, ASN, ISP, hostname enrichment with API. | freemium | Beginner | Safe | Passive | Web/API ip | ipinfo.io | |
| AbuseIPDB | Community-reported IP abuse database with reputation scoring. | freemium | Beginner | Safe | Passive | Web/API ip | abuseipdb.com | |
| RIPE / ARIN / APNIC / LACNIC / AFRINIC | Regional internet registries for IP allocation and registrant lookup. | free | Beginner | Safe | Passive | Web WHOIS ip | iana.org | |
| Netcraft Site Report | Site profiling: hosting, tech stack, history, phishing/malware flags. | free | Beginner | Caution | Passive | Web domain | sitereport.netcraft.com | |
| SpiderFoot | Automated OSINT recon and attack-surface mapping. 200+ modules wired in a publisher/subscriber model (a result from one module becomes the input to every other), most needing no API key. Self-hosted web UI or CLI. MIT-licensed, actively developed since 2012. | freemium | Intermediate | Caution | Active | Python/Self-host domain ip subnet asn email phone username name btc-address | github.com/smicallef/spiderfoot | The all-in-one. Accepts a Bitcoin address as a scan target, so it is the rare general OSINT framework that reaches into on-chain work. Modules run live against third parties, so scan from a burner VPS, never a case network or a home IP. Web UI project page: spiderfoot.net. SpiderFoot HX is the paid cloud variant. Repo checked 2026-08-05 |
| Maltego | Visual link analysis platform with transforms for entity mapping. | freemium | Advanced | Caution | Passive | Desktop domain ip email | maltego.com | |
| theHarvester | Email/subdomain/host collection from public sources (CLI). | free | Intermediate | Caution | Active | Python CLI domain | github.com | |
| Amass | OWASP attack surface mapping & external asset discovery. | free | Advanced | Caution | Active | CLI domain | github.com | |
| ProjectDiscovery Suite | subfinder, httpx, katana, nuclei, modern recon CLI toolkit. | free | Advanced | Caution | Active | CLI domain ip | projectdiscovery.io |
Email OSINT (7 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Hunter.io | Email-finding service: domain to verified addresses, with role/firm metadata. | freemium | Beginner | Caution | Passive | Web/API email domain | hunter.io | |
| Epieos | Email/phone reverse lookup, hosted. One query maps an address to the linked Google account (display name, profile photo, public Maps reviews and photo albums) and to the online services it is registered on, reported as roughly 140. The no-install counterpart to Holehe: same “email to service” question, browser instead of CLI. | freemium | Beginner | Caution | Passive | Web/API email phone | epieos.com | Free tier covers single lookups; a paid subscription (reported around $30/month) unlocks bulk and the full module set. Your query is submitted to a third party, so use a case-specific account. epieos.com returns 403 to automated fetching, so the module count and pricing here come from secondary sources and are NOT confirmed against the vendor: check the site before quoting them. Checked 2026-08-05 |
| EmailRep.io | Email reputation & risk lookup. Reveals known leaks, services seen, suspicious profile. | freemium | Beginner | Safe | Passive | Web/API email | emailrep.io | |
| Holehe | CLI: checks whether an email is registered on 120+ sites (Twitter, Instagram, Discord, GitHub and the rest) by probing each site’s forgotten-password and registration endpoints. Does not alert the account holder. | free | Intermediate | Caution | Passive | Python CLI email | github.com/megadose/holehe | pip or Docker. Several sites rate-limit, so a heavy run needs IP rotation. It hits every target site directly, so read “Passive” as passive-toward-the-subject only: run it from a burner IP. Free and open source, which is why it is the first move before paying Epieos. Repo checked 2026-08-05 |
| Mosint | Automated email OSINT framework chaining many sources. | free | Intermediate | Caution | Passive | Go CLI email | github.com | |
| Castrick Clues | Combined identifier lookup (email, phone, username) with helpful pivots. | free | Beginner | Safe | Passive | Web email phone username | castrickclues.com | |
| EmailHippo | Email validation and risk scoring. | freemium | Beginner | Safe | Passive | Web/API email | tools.emailhippo.com |
Username (4 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| WhatsMyName | Up-to-date username discovery across hundreds of sites. Modern Sherlock alternative. | free | Beginner | Caution | Passive | Web/JSON username | whatsmyname.app | |
| Sherlock | CLI username search: hunts one or more usernames across 400+ social networks and returns the profile URLs it finds. The reference implementation of username enumeration and the baseline everything else is measured against. | free | Intermediate | Caution | Passive | Python CLI username | github.com/sherlock-project/sherlock | pipx install sherlock-project or Docker; the README flags the third-party ParrotOS and Ubuntu 24.04 packages as broken. The site list drifts and newer platforms throw false positives, so pair every hit with WhatsMyName and open the URL yourself before recording it. Repo checked 2026-08-05 |
| Maigret | Username search with profile parsing; more sources than Sherlock. | free | Intermediate | Caution | Passive | Python CLI username | github.com | |
| Namechk | Username availability across many platforms. | free | Beginner | Safe | Passive | Web username | namechk.com |
Phone OSINT (5 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| PhoneInfoga | Phone-number recon: format, carrier, footprint across OSINT sources. | free | Intermediate | Caution | Passive | Go CLI phone | github.com | |
| Truecaller | Crowdsourced caller-ID and reverse phone lookup. OPSEC warning: app uploads your contacts. | freemium | Beginner | High | Passive | Mobile/Web phone | truecaller.com | App uploads your address book by default. Use only on a burner identity. |
| NumLookup | Web-based reverse phone lookup with CNAM/carrier info. | free | Beginner | Safe | Passive | Web phone | numlookup.com | |
| Sync.Me | Reverse lookup and spam-id services for phone numbers. | freemium | Beginner | Caution | Passive | Web/Mobile phone | sync.me | |
| IPQualityScore | Phone/IP/email fraud scoring with risk indicators. | freemium | Intermediate | Safe | Passive | Web/API phone ip email | ipqualityscore.com |
Face Search (4 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| PimEyes | Facial-recognition search across public web. Powerful and ethically fraught, use responsibly. | paid | Advanced | High | Passive | Web image | pimeyes.com | Ethically sensitive. Subject consent and jurisdiction matter. |
| FaceCheck.ID | Aggressive face search engine; often finds matches PimEyes misses. | freemium | Advanced | High | Passive | Web image | facecheck.id | |
| Search4Faces | Face search optimised for VK and Eastern European sites. | freemium | Advanced | High | Passive | Web image | search4faces.com | |
| OSINT.Industries | Real-time identity enrichment across many platforms. Strong phone/email/username modules. | paid | Intermediate | Caution | Passive | Web email phone username | osint.industries |
Image OSINT (7 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| InVID/WeVerify | Industry standard verification toolkit: keyframes, magnifier, metadata, reverse-image. | free | Intermediate | Safe | Passive | Browser extension image | weverify.eu | |
| Forensically | Web image forensics: ELA, clone detection, noise/metadata analysis. | free | Intermediate | Safe | Passive | Web image | 29a.ch | |
| Google Lens / Reverse Image | Broad reverse-image search; strongest for objects and recent web content. | free | Beginner | Caution | Passive | Web image | images.google.com | |
| Yandex Images | Best reverse-image engine for faces and Eastern-European content. OPSEC-sensitive. | free | Intermediate | High | Passive | Web image | yandex.com | Russian infrastructure; consider a clean browser profile. |
| TinEye | Image-origin and duplicate finder. Strongest ‘oldest seen’ pivot. | freemium | Beginner | Safe | Passive | Web image | tineye.com | |
| Bing Visual Search | Microsoft’s reverse image search; strong for landmarks and products. | free | Beginner | Caution | Passive | Web image | bing.com | |
| Aperisolve | Layered steganography analysis: zsteg, steghide, exiftool, binwalk in one. | free | Intermediate | Caution | Passive | Web image | aperisolve.com |
Geolocation (16 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| GeoSpy.ai | AI-powered photo geolocation. 2025-26 game-changer; verify with shadow/weather data. | freemium | Intermediate | Caution | Passive | Web image | geospy.ai | |
| Picarta.ai | Neural-network image geolocation; complementary to GeoSpy. | freemium | Intermediate | Caution | Passive | Web/API image | picarta.ai | |
| Google Earth Pro | High-res satellite imagery, 3D terrain, historical layers. | free | Intermediate | Safe | Passive | Desktop | google.com | |
| Sentinel Hub Playground | Free Copernicus Sentinel satellite imagery, often more recent than Google. | free | Intermediate | Safe | Passive | Web | sentinel-hub.com | |
| Mapillary | Crowdsourced street-level imagery, useful where Street View is limited. | free | Intermediate | Caution | Passive | Web | mapillary.com | |
| OpenStreetMap + Overpass Turbo | Web IDE for the Overpass API: run Overpass QL queries against live OpenStreetMap data and render the hits straight onto a map. The workhorse for turning a photo into a shortlist of places by feature combination (every church with a red roof inside a 2 km radius), then exporting the candidates as GeoJSON. | free | Advanced | Safe | Passive | Web | overpass-turbo.eu | The built-in Wizard writes the QL for you from plain language, which is the fastest way in if you do not know the tag syntax. Queries hit a shared public API, so keep the bounding box tight. Checked 2026-08-05 |
| SunCalc | Sun/shadow position calculator for verifying photo timestamps. | free | Intermediate | Safe | Passive | Web | suncalc.org | |
| Shadow Finder (Bellingcat) | Automated shadow-to-time geolocation analysis. | free | Intermediate | Safe | Passive | Web image | shadowfinder.streamlit.app | |
| Ventusky | Historical weather verification; cross-check claims of rain/wind/temperature. | free | Beginner | Safe | Passive | Web | ventusky.com | |
| ADSBexchange | Unfiltered ADS-B flight tracking; does not block ‘blocked’ tail numbers. | freemium | Intermediate | Safe | Passive | Web | adsbexchange.com | |
| FlightRadar24 | Mainstream flight tracking with strong historical playback. | freemium | Beginner | Caution | Passive | Web | flightradar24.com | |
| MarineTraffic | Vessel tracking with AIS data and port-call history. | freemium | Beginner | Caution | Passive | Web | marinetraffic.com | |
| VesselFinder | Alternative maritime tracker; sometimes covers vessels MarineTraffic misses. | freemium | Beginner | Caution | Passive | Web | vesselfinder.com | |
| Strava Heatmap | Global activity heatmap. Famously useful for sensitive-site discovery. | free | Intermediate | Safe | Passive | Web | strava.com | |
| WiGLE.net | Crowdsourced Wi-Fi network database; geolocate by SSID/BSSID. | freemium | Intermediate | Safe | Passive | Web/API | wigle.net | |
| Wikimapia | Collaborative map annotations. Coverage uneven but unique. | free | Beginner | Safe | Passive | Web | wikimapia.org |
Breach & Exposure (8 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Have I Been Pwned | Authoritative breach database for email/phone with notifications. | freemium | Beginner | Safe | Passive | Web/API email phone | haveibeenpwned.com | |
| DeHashed | Large searchable breach DB. Investigator-favourite, paid tiers. | paid | Advanced | Caution | Passive | Web/API email phone username | dehashed.com | |
| Snusbase | Searchable breach data and paste sites. | paid | Advanced | Caution | Passive | Web email username ip | snusbase.com | |
| LeakCheck.io | Modern, fast breach search alternative to DeHashed. | paid | Intermediate | Caution | Passive | Web/API email username phone | leakcheck.io | |
| Leak-Lookup | Competitor to DeHashed; different coverage. Use both. | freemium | Intermediate | Caution | Passive | Web email username | leak-lookup.com | |
| Intelligence X | Archive + search engine for leaks, pastes, darknet, and historical content. | freemium | Intermediate | Caution | Passive | Web email domain phone | intelx.io | |
| HudsonRock Cavalier | Stealer-log intel. The 2024-26 evolution of breach data, essential. | freemium | Advanced | Caution | Passive | Web/API email domain username | hudsonrock.com | |
| Constella Intelligence | Enterprise identity exposure intel; used by enterprise IR teams. | enterprise | Enterprise | Safe | Passive | Web email username phone | constellaintelligence.com |
Threat Intel (10 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| VirusTotal | Aggregated malware/URL/IP/hash intelligence across 70+ engines. | freemium | Beginner | Caution | Passive | Web/API domain ip hash | virustotal.com | Uploads become visible to VT community/customers. |
| AlienVault OTX | Open Threat Exchange: pulses, IOCs, passive DNS. | free | Beginner | Safe | Passive | Web/API domain ip hash | otx.alienvault.com | |
| MISP | Open-source threat intelligence platform, self-hosted IOC sharing. | free | Advanced | Safe | Passive | Self-host domain ip hash | misp-project.org | |
| Abuse.ch (URLhaus, ThreatFox, MalwareBazaar, FeodoTracker) | Industry-essential malware/phishing/IOC feeds. | free | Intermediate | Safe | Passive | Web/API domain ip hash | abuse.ch | |
| Pulsedive | Threat intelligence search and enrichment. | freemium | Intermediate | Safe | Passive | Web/API domain ip hash | pulsedive.com | |
| ThreatMiner | Free threat-intel search with passive DNS and malware context. | free | Intermediate | Safe | Passive | Web domain ip hash | threatminer.org | |
| Hybrid Analysis | CrowdStrike-backed public malware sandbox. | freemium | Intermediate | Caution | Passive | Web hash domain | hybrid-analysis.com | |
| Joe Sandbox | Deep malware sandbox with strong reporting (community + paid). | freemium | Advanced | Caution | Passive | Web hash | joesandbox.com | |
| ANY.RUN | Interactive malware sandbox, you drive the VM in-browser. | freemium | Advanced | Caution | Active | Web hash domain | app.any.run | |
| MS Defender Threat Intelligence | Formerly RiskIQ PassiveTotal, passive DNS, WHOIS history, crawled web. | freemium | Advanced | Safe | Passive | Web/API domain ip | ti.defender.microsoft.com |
Documents & Metadata (8 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| ExifTool | The standard CLI for reading/writing metadata across images, docs, files. | free | Intermediate | Safe | Passive | CLI image hash | exiftool.org | |
| Metagoofil | Scrape and extract metadata from documents hosted on a target domain. | free | Intermediate | Caution | Active | Python CLI domain | github.com | |
| MAT2 | Metadata anonymisation, strip identifying data before publishing files. | free | Intermediate | Safe | Passive | CLI | 0xacab.org | |
| pdfid / pdf-parser | Inspect PDF structure: scripts, embedded objects, suspicious elements. | free | Advanced | Safe | Passive | Python CLI hash | blog.didierstevens.com | |
| Tesseract OCR | Open-source OCR engine for images and scanned PDFs. | free | Intermediate | Safe | Passive | CLI image | github.com | |
| OCRmyPDF | Adds a searchable OCR text layer to scanned PDFs. | free | Intermediate | Safe | Passive | Python CLI | github.com | |
| Tabula | Extract tables from PDFs into CSV/Excel. | free | Beginner | Safe | Passive | Desktop | tabula.technology | |
| MediaInfo | Detailed metadata for audio and video files. | free | Beginner | Safe | Passive | Desktop/CLI | mediaarea.net |
Social, Twitter/X (3 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Twitter/X Advanced Search | Operators for from/to/since/until, language, geocode, exact phrases. | free | Beginner | Caution | Passive | Web username | twitter.com | |
| Memory.lol | Historical handle to user ID mapping; recover renamed/deleted accounts. | free | Intermediate | Safe | Passive | Web username | memory.lol | |
| Communalytic | Academic-grade Twitter/X (and Reddit, Telegram) community analysis. | freemium | Advanced | Safe | Passive | Web | communalytic.org |
Social, Telegram (5 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| TGStat | Telegram channel analytics, search, and trend tracking. | freemium | Intermediate | Caution | Passive | Web username | tgstat.com | |
| Telegago (CSE) | Google Custom Search Engine focused on indexed Telegram content. | free | Beginner | Safe | Passive | Web | cse.google.com | |
| Lyzem | Telegram public channel/message search engine. | free | Beginner | Caution | Passive | Web | lyzem.com | |
| Telemetr.io | Channel statistics, audience overlap, growth tracking. | freemium | Intermediate | Caution | Passive | Web | telemetr.io | |
| Telepathy | CLI for archival, scraping, and analysis of public Telegram channels. | free | Advanced | Caution | Active | Python CLI username | github.com | Active scraping; use a sock-puppet Telegram account. |
Social, Discord (2 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Discord.id | Discord user ID lookup and timestamp inference. | free | Beginner | Safe | Passive | Web username | discord.id | |
| DISBOARD | Public Discord server directory with search. | free | Beginner | Safe | Passive | Web | disboard.org |
Social, Reddit (2 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Camas (Reddit) | Recover deleted Reddit posts/comments via Pushshift-style archives. | free | Beginner | Safe | Passive | Web username | camas.unddit.com | |
| Redective | Reddit user analytics: subreddit activity, posting patterns. | free | Beginner | Safe | Passive | Web username | redective.com |
Social, Instagram/TikTok (2 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Imginn | Browse public Instagram profiles without an account; story/post archive. | free | Beginner | Caution | Passive | Web username | imginn.com | |
| Picuki | Anonymous Instagram viewer and search. | free | Beginner | Caution | Passive | Web username | picuki.com |
Social, Meta (1 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| WhoPostedWhat | Date-bounded Facebook keyword search via Graph search techniques. | free | Intermediate | Caution | Passive | Web | whopostedwhat.com | Coverage degraded since Graph search removals. |
Social, LinkedIn (1 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Crosslinked | Generate LinkedIn employee permutations for further enumeration. | free | Intermediate | High | Active | Python CLI domain | github.com | Uses Google scraping, burn account required. |
Social, General (3 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Shadow Dragon | Enterprise OSINT platform for digital investigations. | paid | Intermediate | Caution | Passive | Web email phone username | shadowdragon.io | |
| Shadow Dragon FREE Tools | Free supplementary OSINT tools from Shadow Dragon. | free | Beginner | Safe | Passive | Web | shadowdragon.io | |
| Social Searcher | Real-time multi-platform social search for keywords and mentions. | freemium | Beginner | Caution | Passive | Web username | social-searcher.com |
Darknet (4 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Ahmia | Clearnet search engine for .onion sites; safe research entry point. | free | Beginner | Caution | Passive | Web | ahmia.fi | |
| Tor Metrics | Official Tor network statistics: relays, exits, bandwidth. | free | Intermediate | Safe | Passive | Web | metrics.torproject.org | |
| Onion.live | Onion service directory with uptime tracking. | free | Intermediate | Caution | Passive | Web | onion.live | |
| Hunchly | Forensic web-capture browser tool with chain-of-custody. Strong for darknet investigations. | paid | Intermediate | Safe | Passive | Desktop | hunch.ly |
Corporate & Records (6 tools)
Company registries only. For court dockets, judgments, and litigation records see “Court Records & Litigation by Country” near the end of this note.
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| OpenCorporates | Largest open database of corporate entities globally. | freemium | Beginner | Safe | Passive | Web/API | opencorporates.com | |
| SEC EDGAR | US public company filings, primary source for listed-entity research. | free | Intermediate | Safe | Passive | Web | sec.gov | |
| Companies House (UK) | UK official company registry with full filing history. | free | Beginner | Safe | Passive | Web/API | find-and-update.company-information.service.gov.uk | |
| GLEIF (LEI Search) | Global Legal Entity Identifier search, links companies across jurisdictions. | free | Intermediate | Safe | Passive | Web | search.gleif.org | |
| ICIJ Offshore Leaks DB | Panama/Pandora/Paradise Papers searchable database. | free | Intermediate | Safe | Passive | Web | offshoreleaks.icij.org | |
| OpenSanctions (Corporate) | Sanctions, PEPs, watchlists, aggregated and queryable. | free | Intermediate | Safe | Passive | Web/API | opensanctions.org |
Search & Dorking (8 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Google Hacking Database | Canonical Google dork repository. Many dorks are stale, verify before relying. | free | Beginner | Caution | Passive | Web | exploit-db.com | |
| DorkSearch | Web app to construct Google dorks with suggestions. | free | Beginner | Caution | Passive | Web | dorksearch.com | |
| Marginalia Search | Non-SEO indie web search; surfaces content Google buries. | free | Beginner | Safe | Passive | Web | search.marginalia.nu | |
| Wayback Machine | Internet Archive, historical snapshots of websites. | free | Beginner | Safe | Passive | Web domain | web.archive.org | |
| Archive.today | On-demand archival of pages; bypasses some paywalls and JS. | free | Beginner | Safe | Passive | Web domain | archive.ph | |
| GDELT Project | Global event/news/tone analytics across thousands of sources. | free | Advanced | Safe | Passive | Web/API | gdeltproject.org | |
| Wayback Google Analytics | Bellingcat tool, pulls historical GA/GTM IDs from Wayback to pivot to other sites. | free | Intermediate | Safe | Passive | Python CLI domain | github.com | |
| AnalyzeID | Pivot on GA/AdSense IDs, WHOIS, registrant emails across sites. | freemium | Beginner | Caution | Passive | Web domain | analyzeid.com |
Investigator Toolkit (11 tools)
| Tool | Description | Cost | Skill | OPSEC | Mode | Accepts | Website | Notes |
|---|---|---|---|---|---|---|---|---|
| Tor Browser | Anonymity browser; baseline OPSEC tool for sensitive research. | free | Beginner | Safe | Passive | Desktop | torproject.org | |
| Whonix | VM-based OPSEC environment forcing all traffic through Tor. | free | Advanced | Safe | Passive | VM | whonix.org | |
| Tails | Amnesic live OS routing all traffic through Tor. Strong baseline OPSEC. | free | Advanced | Safe | Passive | Live OS | tails.boum.org | |
| Tracelabs OSINT VM | Curated OSINT VM (the modern successor to Buscador). | free | Intermediate | Safe | Passive | VM | tracelabs.org | |
| EFF Cover Your Tracks | Browser fingerprinting test, verify your OPSEC browser is uniqueness-resistant. | free | Beginner | Safe | Passive | Web | coveryourtracks.eff.org | |
| OSINT Framework | Massive curated directory of OSINT resources by category. | free | Beginner | Safe | Passive | Web directory | osintframework.com | |
| Scrapy | Python framework for building scalable web scrapers. | free | Advanced | Caution | Active | Python framework | scrapy.org | |
| Playwright | Modern browser automation, replaces Selenium for most use cases. | free | Intermediate | Caution | Active | Library | playwright.dev | |
| Beautiful Soup | Python HTML parser; building block for custom scrapers. | free | Intermediate | Safe | Passive | Python library | crummy.com | |
| Apify | Cloud scraping/automation platform with prebuilt actors for many sites. | freemium | Intermediate | Caution | Active | Cloud | apify.com | |
| IOC Web Scraper | Intelligence on Chain’s open-source scraping framework, links & images. | free | Advanced | Caution | Active | Python framework domain | github.com |
Consolidated additions
Merged from the BlockchainUnmasked article “The Investigator’s Stack: The Tools Every Team Should Know” (2026-06). These extend the catalogue above with tracers, bridge/swap explorers, scam databases, and a Freezing/Recovery category the base catalogue did not cover. Lighter column schema (no OPSEC/Skill ratings invented for these entries).
Additional Tracing & Attribution Platforms
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| Global Ledger | Proprietary tracer with strong datasets & attribution | paid | globalledger.io | Praised for clean UI, node customization, color-coding (graph readability) |
| CipherOwl | Tracer that adds counterparties directly onto the graph | paid | cipherowl.ai | Paste a node and it auto-connects to others on the canvas |
| Crystal Intelligence | Institutional analytics | enterprise | crystalintelligence.com | Cross-chain coverage, behavioral typologies |
| Merkle Science | Institutional analytics | enterprise | merklescience.com | Cross-chain coverage, behavioral typologies |
| Nominis | Proactive entity tagging/labelling | freemium/paid | nominis.io | ”Shadow Intelligence” links Web3->Web2 footprints; depth on terrorism data |
Cross-Chain Bridge Explorers
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| Range Cross-Chain Explorer | Single view across many bridges | freemium | range.org | Stitch a source-chain tx to its destination leg |
| NEAR Intents Explorer | Intent/solver bridge explorer (31+ chains) | free web; API needs JWT | explorer.near-intents.org | Keyed by settlement tx; resolves source chain/asset + deposit tx + user intent account. Solver acct is NOT the suspect |
| Bridge Explorer (unbridge) | Free multi-bridge correlation | free | unbridge.xyz | |
| Wormholescan | Wormhole bridge explorer | free | wormholescan.io | |
| LayerZeroScan | LayerZero messaging explorer | free | layerzeroscan.com | |
| deBridge Explorer | deBridge transfers | free | explorer.debridge.finance | |
| THORChain / Runescan | THORChain swaps | free | thorchain.net / runescan.io | |
| Mayan Explorer | Mayan cross-chain swaps | free | explorer.mayan.finance | Mayan swaps emit Wormhole VAAs, so they also resolve on Wormholescan |
| Allbridge | Allbridge transfers | free | allbridge.io | Core explorer at core.allbridge.io/explorer; search by sender, recipient, tx or transfer ID |
| Axelarscan | Axelar general message passing | free | axelarscan.io | message_id = source tx hash + log index, from the Gateway ContractCall event. Squid routes resolve here too |
| Circle CCTP (CCTPScan) | Native USDC burn-and-mint transfers | free | developers.circle.com | The cleanest bridge to trace. DepositForBurn + MessageSent -> MintAndWithdraw. V1 and V2 use separate contracts and nonce spaces |
| Synapse Explorer | Synapse liquidity-network transfers | free | explorer.synapseprotocol.com | GraphQL. Liquidity network, so match amount minus fee and timestamp. Lookalike front ends circulate: use this domain only |
| Hop Explorer | Hop transfers | free | explorer.hop.exchange | Extract the TransferSent event and its transferId |
| Celer cBridge | cBridge transfers | free | cbridge.celer.network | transferId (keccak256). Status API returns both legs in one response, see Bridge Resolution APIs |
| Across | Intent/solver bridge fills | free | across.to | V3FundsDeposited -> FilledV3Relay (V4 renamed both). The relayer fronts the funds: the destination payer is the solver, NOT the suspect |
| Socketscan (Socket/Bungee) | Aggregator route lookup | free | socketscan.io | Confirm the current post-rebrand domain. Do NOT treat the aggregator as the bridge: identify each leg’s underlying bridge |
| LI.FI / Jumper status | Meta-router status by tx hash | free | li.fi / jumper.exchange | Returns PENDING/DONE/FAILED/PARTIAL/REFUNDED. PARTIAL and REFUNDED flag a failed hop that may have returned funds to a DIFFERENT address |
| Orbiter Explorer | L2-to-L2 Maker-model transfers | free | explorer.orbiter.finance | No event log to parse: transfers go to a Maker EOA. Routing is encoded in the trailing digits of the amount, so preserve full precision |
| Chainflip Scan | Native cross-chain DEX swaps | free | scan.chainflip.io | Swap ID + deposit channel, e.g. 6543210-Ethereum-1933. Intent-style, so vendor coverage is weak |
| Everclear Explorer | Intent-based clearing (ex-Connext) | free | explorer.everclear.org | intentId + Hyperlane message_id; cross-check the Hyperlane explorer. Legacy: connextscan.io |
| Hyperlane Explorer | Interchain messaging | free | explorer.hyperlane.xyz | message ID = keccak256(message) via Mailbox.dispatch. Often the transport layer BENEATH another protocol: identify what is riding on it |
| Chainlink CCIP Explorer | CCIP messages and token transfers | free | ccip.chain.link | messageId generated on the source chain; shows both legs and status |
| Mintscan | Cosmos IBC packets | free | mintscan.io | Packet sequence + channel IDs, port “transfer”. The denom encodes the path (transfer/channel-X), so multi-hop routes reconstruct from the denom alone |
| Nine Realms THORChain tracker | THORChain swap tracking | free | track.ninerealms.com | Paired with the Midgard and THORNode APIs below |
~80-90% of bridge use is ordinary infrastructure, not obfuscation. Most bridges maintain their own dedicated explorer, search the bridge name.
Vendor tools auto-resolve the deterministic message-identifier bridges (Wormhole, CCTP, LayerZero/Stargate, Axelar, CCIP, IBC, native rollup bridges). Coverage is weak or absent for intent/solver bridges (Across, deBridge, Chainflip, Relay, Everclear), where the legs are linked only by an off-chain order ID: a vendor tool showing no link does not mean no link exists. Full breakdown: “Operational Tracing Runbook: Live Mixers Bridges and No-KYC Swaps” (04-laundering-obfuscation).
Bridge Resolution APIs
Programmatic endpoints that bind a source leg to a destination leg. Prefer these over screenshots where you can: the raw JSON response is a citable, reproducible exhibit, and several dead bridges prove you cannot re-derive what you did not capture.
| API / endpoint | What it returns | Access | Where | Notes |
|---|---|---|---|---|
| Circle Iris attestation API | The attestation for a CCTP message hash, binding burn to mint | free | developers.circle.com | Hash the MessageSent body to get the message hash, then resolve. Confirm V1 vs V2 for your period |
| cBridge status API | Source AND destination block tx links in one response | free | cbridge-docs.celer.network | POST the transfer_id. One of the cleanest single-response exhibits available from any bridge |
| LayerZero Scan API | GUID, DVN set, executor, destination tx, delivery status | free | layerzeroscan.com | Query by source tx hash. Note the v1 to v2 transition when working historical periods |
| Wormholescan global transaction endpoint | VAA lookup by (emitter_chain, emitter_address, sequence) | free | wormholescan.io | Also resolves Mayan swaps. Token Bridge yields a wrapped asset, NTT yields native |
| THORNode API | Current Asgard inbound vault addresses, network state | free | gateway.liquify.com/chain/thorchain_api | /thorchain/inbound_addresses. Vaults churn circa every 3 days, so NEVER cache a vault address: resolve it for the relevant date. The old thornode.ninerealms.com host no longer resolves (checked 2026-08-17). Historical /thorchain/block?height=N returns “No archive nodes configured”: there is no public archive node, so date old heights via Midgard instead |
| Midgard API | THORChain swap records linking inbound to outbound, plus height-to-timestamp pairs | free | gateway.liquify.com/chain/thorchain_midgard/v2 | Often the only reliable link: the legs are separate txs on different chains joined only by THORChain state. Read the memo, which frequently carries the destination address in clear text. /v2/actions?height=N returns records carrying both height and a nanosecond date, which is how you date a THORChain block with no archive node. midgard.ninerealms.com no longer resolves (checked 2026-08-17) |
| deBridge DLN stats / orders API | Order records searchable by tx, sender or receiver | free | app.debridge.finance/orders | Deterministic orderId. The destination filler is a solver, not the subject |
| Across API | depositId, originChainId, indexed relayer | free | across.to | Confirm the contract version: V4 renamed the deposit and fill events |
| Synapse explorer GraphQL | Transfers by tx hash, chain and token | free | explorer.synapseprotocol.com | Liquidity network, so match amount minus fee and timestamp rather than following a coin |
| Relay API | Order records | free | relay.link | No public event schema verified, so treat the API record as the primary artefact and corroborate on amount and timing |
| LI.FI status endpoint | Route status + explorer link for the underlying leg | free | li.fi | Then trace the underlying bridge leg with that bridge’s own identifier logic |
Instant-Swap / Instant-Exchange Services
Increasingly an obfuscation layer of choice; several are cooperative with investigators and LE. See “Cooperating Instant Exchanges as Pivot Points” (02-tracing).
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| FixedFloat | No-account instant swap | open | fixedfloat.com | Common obfuscation hop |
| ChangeNOW | Instant swap | open | changenow.io | Cooperative in many cases |
| Changelly | Instant swap | open | changelly.com | |
| SimpleSwap | Instant swap | open | simpleswap.io |
Additional Infrastructure & Domain OSINT
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| Silent Push | Domain/infrastructure intelligence | freemium | silentpush.com | |
| DomainTools | WHOIS, historical & reverse WHOIS | paid | domaintools.com | |
| WhoisXML API | WHOIS/DNS data via API | freemium | whoisxmlapi.com | |
| Netlas | Internet asset scan engine | freemium | netlas.io | Second pass when Shodan/Censys come up short |
| Validin | Pivot on favicon/CSS/HTML hashes, TLS/JARM, HTTP banners, passive DNS to cluster domains | freemium | validin.com | Favorite for infra clustering; one reused favicon can crack a phishing network |
| BuiltWith | Tech-stack & analytics-ID fingerprinting | freemium | builtwith.com | Surfaces GA/tracking IDs operators forget to scrub |
| Wappalyzer | Tech-stack detection | freemium | wappalyzer.com |
Scam & Phishing Databases
Cross-reference artifacts against reported data. (Chainabuse, ScamSniffer, and URLhaus already appear in the catalogue above.)
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| GASO (Global Anti-Scam Org) | Reported scam domains & infrastructure | free | globalantiscam.org | |
| PhishDestroy | Phishing & wallet-drainer intelligence | free | phishdestroy.io | |
| CryptoScamDB | Crypto scam address/domain database | free | cryptoscamdb.org | |
| ScamAdviser | Website trust / scam scoring | free | scamadviser.com | |
| PhishTank | Community phishing URL database | free | phishtank.org | |
| OpenPhish | Phishing feed | freemium | openphish.com |
Case Documentation
(Hunchly and Maltego already appear in the catalogue above.)
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| Obsidian | Local-first linked-markdown case notes | free | obsidian.md | See “Obsidian Case-Management Workflow” (06-casework-method) |
| Notion | Structured case notes / collaboration | freemium | notion.com | Cloud-hosted, mind OPSEC for sensitive cases |
Freezing, Blacklisting & Recovery
Investigators/LE drive the reporting, blacklisting, and freezing half (in partnership with LE); recovery sits with LE and specialist firms. Freezes are actioned at law-enforcement request.
| Tool / Channel | What it does | Access | Website | Notes |
|---|---|---|---|---|
| Tether (USDT issuer freeze) | Token-level freeze of USDT | LE request | tether.to | Route the request to the issuer directly or via the right intermediary |
| Circle (USDC issuer freeze) | Token-level freeze of USDC | LE request | circle.com | |
| T3 Financial Crime Unit (T3 FCU) | Tether/TRON/TRM initiative; freezes illicit USDT-on-TRON, often within 24h | LE request | t3fcu.org | T3+ brings exchanges into real-time coordination; the channel for USDT-on-TRON |
| TRM Beacon Network | Real-time network to coordinate freezing stolen funds during a live incident | free for verified LE & exchanges | trmlabs.com | Speed-oriented |
| Exchange LE portals | Dedicated law-enforcement request channels at major exchanges | verified LE | , | Learn each exchange’s “front door” |
| MistTrack stablecoin blacklist lookup | Check whether an address is already frozen/blacklisted | free | misttrack.io | Quick pre-check before chasing |
| Deconflict | Tells you whether another agency is already working the wallet/case | verified LE only | deconflict.com | Avoids duplicated effort / colliding with a live op |
| Kodex | Secure, auditable data requests from agencies to exchanges/institutions; verifies LE-agent identity against a global network (roughly 15k agencies, 140k+ agents, 190 countries) to block fraudulent requests | verified LE / institutions | kodexglobal.com | Founded 2020 by former FBI agent Matt Donahue; used by major exchanges (Coinbase, Crypto.com). Also under “Law Enforcement Liaison & Cross-Sector Coalitions” below. Verified 2026-07-12 |
| Asset Reality | Specialist asset recovery & management | firm | assetreality.com | Recovery-side |
| DigitalMint | Recovery / ransom-settlement services | firm | digitalmint.io | Recovery-side |
Law Enforcement Liaison & Cross-Sector Coalitions
Bodies and channels that connect investigators, the private sector, and law enforcement to share intelligence, make warm introductions, deconflict, and route requests. See “Working with Law Enforcement: Capacity, Speed, and Cross-Sector Coalitions” (05-evidence-legal). Kodex, Deconflict, and T3 FCU also appear under “Freezing, Blacklisting & Recovery” above.
| Org / Channel | What it is | Access | Website | Notes |
|---|---|---|---|---|
| Operation Shamrock | Nonprofit coalition uniting law enforcement, industry, and the public to disrupt pig-butchering scams; founded by former Santa Clara DDA Erin West. Runs the “Crypto Coalition”, a 2,400+ member network of local/state/federal/international partners sharing crypto crime-fighting technique | free / membership (Coalition is verified LE) | operationshamrock.org | Verified 2026-07-12 |
| IAFCI | International Association of Financial Crimes Investigators. 501(c)(6) global body of public and private financial-crime, fraud, cyber, and LE professionals; intelligence exchange, chapters, conferences, and certifications. Lineage: ACCI 1968, IACCI 1974, renamed IAFCI 1996 | membership | iafci.org | Verified 2026-07-12 |
| Kodex | Verified LE-to-institution request channel (see “Freezing, Blacklisting & Recovery” above) | verified LE / institutions | kodexglobal.com | Cross-listed |
The three-piece investigator workflow (framing)
Every investigation breaks into three pieces (per the stack article):
- Investigation & Tracing, heavyweights (TRM, Chainalysis, Elliptic) + next-tier tracers (Global Ledger, CipherOwl, MistTrack) + freemium graphs (Breadcrumbs, MetaSleuth) + free attribution/clustering (Arkham, Bubblemaps) + base-layer explorers (Etherscan, OKLink, mempool.space). Bridges/swaps via dedicated + aggregate explorers; instant-swaps often need temporal+amount matching or direct outreach.
- Identification & OSINT, the hardest half: link on-chain address -> entity -> real person (Web3 -> Web2). Exchange KYC is the gold standard but LE-gated. When it is not available, pivot via domain/infra intel (Validin, Silent Push, Shodan/Censys, crt.sh), tech-stack IDs (BuiltWith/Wappalyzer), person pivots (Epieos, OSINT Industries, Holehe), and scam DBs; preserve with Wayback/archive.today. Document everything (Obsidian/Notion/Hunchly/Maltego).
- Freezing, Blacklisting & Recovery, report/blacklist/flag wallets so institutions can freeze; issuer freezes (Tether/Circle), T3 FCU, TRM Beacon; LE-only coordination via Deconflict/Kodex; recovery via Asset Reality/DigitalMint.
Additions from IOC Level 2 (June) Session 1
Tools shown in Intelligence on Chain’s Level 2 (June) Blockchain & OSINT Investigations course, Session 1. Lighter schema (no OPSEC/Skill ratings). Confirm current URLs before relying on them. The instructor demonstrated an OP_RETURN decoder site but explicitly flagged it as low-trust, so it is deliberately not listed here.
Bridge & cross-chain explorers / utilities
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| Relay Explorer | Relay.link cross-chain transfer lookup | free | relay.link | Search by tx hash or address; seen routing via a Bitcoin OP_RETURN memo |
| chainlist.org | Resolve an EVM chain ID to its chain | free | chainlist.org | Decode the “destination chain ID” field found in bridge input data |
| Arbiscan | Arbitrum explorer (Etherscan family) | free | arbiscan.io | The L1-deposit vs L2-withdrawal tabs expose the bridge legs |
| TronScan address converter | Convert an EVM-hex recipient into a Tron (T…) address | free | tronscan.org | Keep the 0x, strip the leading zeros after it; see “Decoding a Cross-Chain Destination Address from Input Data” |
Tracing / case tooling
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| Spectra (IOC) | Intelligence on Chain’s own tracer plus a terminal case manager | paid/community | intelligenceonchain.com | Auto-exchange time-and-value matching with a configurable tolerance (~$200 default) |
| IOC OSINT Toolkit | IOC-hosted, filterable directory of 170+ investigation tools | free | osint.intelligenceonchain.com | The live version of much of this catalogue |
Email / domain OSINT
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| MXToolbox | Email header analysis; SPF/DKIM/DMARC checks; return-path vs sender for spoof detection | freemium | mxtoolbox.com | Paste a raw email header to expose routing and spoofing |
| Whoxy | WHOIS lookup plus reverse/historical WHOIS for registrant-email pivots | freemium | whoxy.com | Registrant data is privacy/GDPR-limited in many regions |
Additions from OSINT Excellence Cheat-Sheet Collection (Alex Lozano / cibergy), ingested 2026-07-12
Source: “OSINT Excellence - Cheat Sheet Collection” (Alex Lozano, cibergy.com / osintexcellence.org). Most of the collection duplicated notes and tools already here and was discarded; the genuinely additive, non-duplicative resources are the country-level corporate registries below and the OSINT handbooks/curated stacks. Every URL was link-checked 2026-07-12: 200 = live; 403 = live but bot-protected (open in a real browser); egrul/bizstats block automated checks entirely but are confirmed real (see notes). Lighter schema (no OPSEC/Skill ratings). Registries marked “official” are government/court sources; the rest are commercial aggregators. Confirm the current URL before relying on any entry.
Corporate Registries by Country (Europe)
For FININT / due-diligence / entity-attribution work: following fiat off-ramps, shell companies, directors, and beneficial owners behind a crypto case. Complements the cross-jurisdiction sources in “Corporate & Records” above (OpenCorporates, GLEIF, ICIJ Offshore Leaks). OpenCorporates and North Data both span multiple countries and are listed once.
| Country | Registry / resource | What it is | Website | Notes |
|---|---|---|---|---|
| Germany | Handelsregister | Official German commercial register | handelsregister.de | Court-operated; the primary DE source |
| Germany | Bundesanzeiger | Federal Gazette, official company financial filings | bundesanzeiger.de | Where DE annual accounts are published |
| Germany | Unternehmensregister | Official consolidated company-register portal | unternehmensregister.de | Single entry point across DE registers |
| Germany | Creditreform (Firmeneintrag) | Commercial credit / company data | firmeneintrag.creditreform.de | 403 to bots; opens in a browser |
| DE/EU | North Data | Commercial company-data aggregator (DE + wider EU) | northdata.de | Cross-jurisdiction; strong ownership graphs |
| UK | Companies House | Official UK company registry + full filing history | find-and-update.company-information.service.gov.uk | Also in “Corporate & Records” above |
| UK | The Gazette | Official public record (insolvency/statutory notices) | thegazette.co.uk | Official |
| UK | Company Check | Commercial UK company & director data | companycheck.co.uk | |
| UK | BizStats | Free UK company info (Open Government Licence data) | www.bizstats.co.uk | Blocks automated checks; confirmed live via search |
| France | Infogreffe | Official registry of the French commercial courts | infogreffe.fr | Official |
| France | BODACC | Official bulletin of civil & commercial announcements | bodacc.fr | Official |
| France | Pappers | Free/freemium FR company data | pappers.fr | Good free tier |
| France | Societe.com | Commercial FR company data | societe.com | |
| France | Verif | Commercial FR company data | verif.com | |
| Italy | Registro delle Imprese | Official Italian business register | registroimprese.it | Official |
| Italy | InfoCamere | Chambers-of-commerce registry operator | infocamere.it | Runs the IT register infrastructure |
| Italy | Empresite | Commercial IT company directory | empresite.it | |
| Italy | Pagine Gialle | Business directory (yellow pages) | paginegialle.it | Directory, not a legal register |
| Russia | EGRUL (Federal Tax Service) | Official unified state register of legal entities | egrul.nalog.ru | Official; typically geo-restricted to RU IPs |
| Russia | Rusprofile | Company-data aggregator | rusprofile.ru | 403 to bots; opens in a browser |
| Russia | Zachestnyi Biznes | Company-data aggregator | zachestnyibiznes.ru | 403 to bots; opens in a browser |
| Russia | List-Org | Company directory | list-org.com | |
| Russia | Kontur Focus | Commercial due-diligence platform | focus.kontur.ru | 403 to bots; opens in a browser |
| Spain | Registro Mercantil Central | Official central commercial registry | rmc.es | Official |
| Spain | BORME (via BOE) | Official Mercantile Registry gazette | boe.es | Official |
| Spain | Librebor | Free access to BORME filings | librebor.me | Free BORME mirror |
| Spain | Axesor | Commercial company / credit data | axesor.es | |
| Spain | Datoscif | Company financial data | datoscif.es | |
| Netherlands | KvK | Official Dutch Chamber of Commerce business register | kvk.nl | Official |
| Netherlands | OpenKvK | Open access to KvK data | openkvk.nl | |
| Netherlands | Drimble | Public-records / company-info aggregator | drimble.nl | |
| Netherlands | DNB public register | De Nederlandsche Bank register of licensed financial institutions | dnb.nl/en/public-register | Official; NB this is the central bank (not Dun & Bradstreet) |
| Global | Dun & Bradstreet | Global business-data / DUNS | dnb.com | 403 to bots; distinct from dnb.nl above |
| Switzerland | Zefix | Official central business-name index | zefix.ch | Official |
| Switzerland | SHAB | Swiss Official Gazette of Commerce | shab.ch | Official |
| Switzerland | Moneyhouse | Commercial CH company data | moneyhouse.ch | |
| Switzerland | SIX Swiss Exchange | Listed-company disclosures | six-group.com | For listed entities |
| Switzerland | Swissreg | Official trademark / patent register (IP, not companies) | swissreg.ch | IP register, use for brand/IP links, not company filings |
OSINT Handbooks, Guides & Curated Stacks
Free reference / learning resources. Verified 2026-07-12.
| Resource | What it is | Access | Website | Notes |
|---|---|---|---|---|
| Toddington OSINT cheat sheets | Free library of OSINT cheat sheets & resources | free | toddington.com/resources/cheat-sheets/ | OCR in the source mangled this as “toddinton”, corrected |
| AJMI Open Source Investigation Handbook | Al Jazeera Media Institute OSINT handbook (EN/AR) | free | institute.aljazeera.net/en/node/2111 | Ethics, geolocation, ships/planes, satellite, corporate ownership |
| Blackdot Solutions, The OSINT Handbook | Vendor OSINT handbook | free (email gate) | blackdotsolutions.com/the-osint-handbook | Anti-Financial-Crime edition is more crypto-relevant: blackdotsolutions.com/osint-handbook-for-afc |
| Recorded Future, The Intelligence Handbook (4th ed.) | 198-page intelligence-led security program guide | free (email gate) | go.recordedfuture.com/the-intelligence-handbook-fourth-edition | Includes fraud/identity/attack-surface intel chapters |
| OSINT Handbook (osinthandbook.com) | Independent OSINT reference site | free | osinthandbook.com | |
| OSINT Combine, OSINT Bookmark Stack | Curated importable browser bookmark set of OSINT tools | free | osintcombine.com/free-osint-tools/osint-bookmark-stack | |
| OSINT Combine, Dark Web Bookmark Stack | Curated dark-web research bookmark set | free | osintcombine.com/free-osint-tools/darkweb-bookmark-stack | Pair with the Darknet tools above |
Additions from DFRWS EU 2025 mixer research, ingested 2026-07-28
Sources: Zavrel et al., “Tumbling down the stairs” (FSI:DI 52 (2025) 301869) and Tippe & Deckers, “Unmixing the mix” (FSI:DI 52 (2025) 301876). Tooling used to build and query a local Bitcoin transaction graph, plus the attribution and reporting sites the two teams pivoted through. Lighter schema (no OPSEC/Skill ratings). Bitcoin Core, Mempool.space, Crystal Intelligence, and Chainabuse already appear above; only the additive detail is recorded here.
Self-hosted chain analysis (build your own graph)
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| Neo4j | Graph database; import the Bitcoin chain as blocks, transactions, and addresses, then query it in Cypher | freemium / self-host | neo4j.com | The 2025 study imported 2 billion+ nodes. Bulk import is far faster than per-transaction inserts. Shortest-path queries surface links that a visual graph hides |
| btc-csv (Sommer, 2019) | Extracts raw Bitcoin blockchain data into CSV shaped for Neo4j bulk import | free | files.ifi.uzh.ch (UZH thesis) | Address decoder library is stale (2020) and cannot parse Taproot; the authors had to patch it. Budget time for that |
| BlockSci | Open-source blockchain analysis platform (Kalodner et al., USENIX Security 2020) | free | github.com/citp/BlockSci | Unmaintained since 2020; rejected by the 2025 study for that reason. Still the reference implementation to read |
| Bitcoin Core | Full node; the primary source of raw chain data and of forward/backward input-output links | free | bitcoincore.org | Paired with mempool.space in the fingerprinting study |
| transactionfee.info | Charts of Bitcoin transaction statistics, including the share of 1-input/2-output transactions | free | transactionfee.info | Source of the “roughly 75 percent of transactions are <1:2>” baseline |
Address risk, attribution & community reports
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| AMLBot | Address risk scoring and taint percentage for BTC and other chains | freemium | amlbot.com | Used as the cross-check against Crystal. Does not publish its data sources or methodology. See “Vendor Risk Scores Disagree, and a Mixer Lowers Them” |
| Crystal Blockchain / Crystal Intelligence | Institutional analytics with taint scoring and entity attribution | freemium / enterprise | crystalintelligence.com | Also listed under Additional Tracing & Attribution Platforms above. Free tier ran to 15 checks per day as of the 2025 study |
| TokenScope | Address attribution and OSINT lookups on BTC addresses | free / freemium | tokenscope.com | Used to attribute peel-chain inputs to a named darknet market |
| CheckBitcoinAddress | Community-reported scam and ransomware reports tied to BTC addresses | free | checkbitcoinaddress.com | Cross-reference identified customer payout addresses against public reports |
CoinJoin coordinator discovery
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| Wasabist | Public directory of active Wasabi CoinJoin coordinators | free | wasabist.io | Wasabi shut its own coordinator in 2024, so activity moved to third-party coordinators. This is where you find who is running them now |
| Kukks coordinator list (nostr) | Alternative published list of Wasabi coordinators | free | github.com/Kukks/wasabinostr | Same purpose as Wasabist; different set |
| Wasabi Nostr announcement feed | Where coordinators announce rounds | free | relay: wss://relay.primal.net | There is NO on-chain coordinator tag. Attributing a WabiSabi round to a coordinator means matching the coinjoin txid and timing to an announcement. Record the relay + announcement event id as the artefact |
| Liquisabi | Community WabiSabi round tracker | free | see Wasabi community listings | Cross-reference alongside Wasabist when attributing a round |
Event Signature & Selector Lookup
The highest-yield free step when you do not know what a contract is: take each log’s topics[0] and reverse it to an event signature. Also reverses a 4-byte function selector from an unverified contract’s input. Both are free and need no key. Recompute rather than trust a copied hex, see “Operational Tracing Runbook: Live Mixers Bridges and No-KYC Swaps” (04-laundering-obfuscation) section 3.
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| openchain.xyz signature database | Reverse a topic0 or 4-byte selector to its signature | free | openchain.xyz | Primary lookup. Broader coverage than 4byte in practice |
| 4byte.directory | Reverse a function selector or event topic | free | 4byte.directory | The original; keep both, coverage differs |
| Blockscout / Etherscan Logs tab | Read topic0 AND the decoded signature straight off the chain | free | blockscout.com / etherscan.io | The most reliable route: no lookup needed, the chain tells you. Also shows which params are indexed (filterable) vs in data (not) |
cast keccak (Foundry) | Compute a topic0 locally from a canonical signature | free | getfoundry.sh | cast keccak "Deposit(bytes32,uint32,uint256)". Canonical types, no spaces, no param names |
Privacy-Coin & CoinJoin Explorers
Free explorers for the chains where the boundary is the only tractable edge. Privacy assets are traced at the transparent boundary (shield/deshield, peg-in/peg-out, mint/spend), never inside the pool.
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| whirlpoolstats.xyz (Whirlpool.Observer) | Tracks Whirlpool pools, Tx0s and mix cycles | free | whirlpoolstats.xyz | Covers the 0.025 and 0.25 BTC pools. Use to find the Tx0, which is the depositor-linking artefact |
| litecoinspace.org/mweb | Litecoin MWEB peg-in / peg-out explorer | free | litecoinspace.org/mweb | A peg-out is NOT a standalone tx: it is an output inside the HogEx, the always-last tx in each block. Peg-in amounts are visible |
| mwebexplorer.com | Alternative MWEB explorer | free | mwebexplorer.com | Second source for MWEB boundary events |
| Nighthawk zcash-explorer | Open-source Zcash explorer that classifies tx type and pool | free | github.com/nighthawk-apps/zcash-explorer | Tells you which pool (Sapling / Orchard / transparent) a tx touched |
| zcha.in | Zcash turnstile / pool migration view | free | zcha.in | For turnstile analysis between shielded pools |
| zkp.baby | Live Zcash shielded pool balances | free | zkp.baby | Size the anonymity set per pool at a point in time |
| Blockchair (Zcash / Dash) | Multi-chain explorer covering ZEC and DASH | free | blockchair.com/zcash, /dash | For Dash: detect PrivateSend as N equal in / N equal out of one denomination with no change |
| Firo explorer | Firo / Lelantus Spark explorer | free | explorer.firo.org | Spark addresses are NOT searchable and amounts are hidden. Only the mint and spend-to-transparent boundaries are tractable |
| Envio Privacy Pools indexer | Open-source indexer for every 0xbow Entrypoint and pool | free / self-host | github.com/enviodev/privacy-pools | Covers Ethereum, Optimism, BSC, Arbitrum. Use the live Merkle leaf count as the anonymity-set ceiling. Beats hand-rolling log queries |
| kycnot.me | Tracks which no-KYC swap services are actually live and their KYC posture | free | kycnot.me | Verify a swap service is operating BEFORE building a theory on it |
| SolanaFM | Parsed Solana instructions incl. inner instructions (CPIs) | freemium | solana.fm | Essential: on Solana the real transfer is a CPI under a router, and naive from/to fails |
| TronGrid API | Tron events and tx info endpoints | free tier | trongrid.io | /v1/contracts/{address}/events and /wallet/gettransactioninfobyid. Also check energy delegation: the delegator is a lead |
Court Records & Litigation by Country, added 2026-08-05
Why court records belong in a crypto-forensics catalogue: filings are the cheapest bridge from a pseudonym to a person. Civil complaints, indictments, and above all US civil-forfeiture filings routinely name subject wallet addresses in full, sitting alongside the parties’ legal names, street addresses, employers, aliases, co-defendants, and counsel, and they are public the moment they are docketed. That makes a docket search both an identity source and, in the US, a direct on-chain attribution source. Bankruptcy and receivership dockets are separately where creditor lists, asset schedules, and exchange subpoenas surface.
Three caveats before you lean on any of this. (1) An index is not the filing: most systems return metadata and you still pay for or formally request the document. (2) Coverage skews hard toward appellate and superior courts in most countries; trial-level records are often offline, in-person only, or sealed. (3) Absence of a record is not evidence of absence, and that is sharpest with RECAP, which holds only what somebody already bought. Link-checked 2026-08-05 unless a row says otherwise; confirm the current URL before relying on any entry.
Court Records: United States
| Resource | What it is | Access | Website | Notes |
|---|---|---|---|---|
| PACER Case Locator (PCL) | Official national index across US district, bankruptcy, and appellate courts | free account, $0.10/page | pcl.uscourts.gov | The starting point when you do not know which court. Case search, advanced search (region, date range), party search, bankruptcy search. Updates nightly, so it is NOT real time: new cases typically appear within 24 hours. Documents are $0.10 per page capped at $3.00 per document, and fees are waived at $30 or less per quarter, which covers most single-case research. Registration is mandatory and every search is logged and billed to your identity, so it is an attributable action |
| CourtListener / RECAP (Free Law Project) | Free archive of PACER dockets and documents plus federal and state case law, with a REST API, bulk data, and docket alerts | free | courtlistener.com | Check here before spending a cent on PACER. Non-profit. RECAP contains only what a user already purchased and contributed, so a gap means nobody bought it, not that nothing was filed. The browser extension donates what you buy back into the archive |
| judyrecords | Free nationwide full-text search across US state and county court cases | free | judyrecords.com | Claims 770 million+ cases, well beyond PACER’s federal-only scope. This is the state-court layer, which is where most ordinary civil and criminal matters actually live |
| UniCourt | Commercial aggregator of state and federal dockets with normalised data and an API | freemium | unicourt.com | A handful of free searches, then paywalled. The value is standardised cross-court party matching, not the raw records |
| Individual court CM/ECF | The live docketing system at each federal court | PACER account | pacer.uscourts.gov | Where you go for same-day filings PCL has not indexed yet |
| State and county portals | Each state runs its own; there is no single national index | varies | (per state) | Quality is wildly uneven. Find the case via judyrecords or UniCourt, then pull the authoritative record from the state portal |
Court Records: UK & Ireland
| Resource | What it is | Access | Website | Notes |
|---|---|---|---|---|
| Find Case Law (The National Archives) | Official source for judgments and decisions of the courts and tribunals of England and Wales | free | caselaw.nationalarchives.gov.uk | Now hosts the official versions of many judgments that used to exist only on BAILII. Regularly receives the Privy Council, UK Supreme Court, Court of Appeal, High Court, Upper Tribunals, Investigatory Powers Tribunal and Employment Appeal Tribunal, plus some Family Court, Court of Protection, County Court and Crown Court judgments |
| BAILII | Free case law and legislation for the UK and Ireland, across all court levels | free (donation and subscription funded) | bailii.org | Still the broadest single UK/IE database and the deepest historically. Run it alongside Find Case Law, not instead of it |
| Courts Service of Ireland | Official Irish courts site: judgments, legal diary, court services | free | courts.ie | Not link-checked in this pass; confirm before relying on it |
| The Gazette | Official UK public record: insolvency, winding-up, and statutory notices | free | thegazette.co.uk | Also listed under Corporate Registries above. The route to bankruptcy and liquidation events on a UK subject |
| Registry Trust (TrustOnline) | Official register of UK county court judgments and judgment debts | paid per search | trustonline.org.uk | Not link-checked in this pass. The canonical answer to “does this person or company have an unsatisfied CCJ” |
Court Records: Europe
| Resource | What it is | Access | Website | Notes |
|---|---|---|---|---|
| European e-Justice Portal, National case law | The EU’s official gateway mapping, per member state, which case-law databases exist and what each covers | free | e-justice.europa.eu/13/EN/national_case_law | Start here for any EU country not broken out below. Most member states publish supreme-court decisions online; lower courts are patchy |
| ECLI search engine | Multilingual search across every publisher that adopted the European Case Law Identifier standard | free | e-justice.europa.eu | An ECLI resolves one decision across jurisdictions, the closest thing the EU has to a universal case citation |
| Common Portal of Case Law | Parallel search across the case-law databases of the EU supreme judicial courts, run by the Network of Presidents | free | network-presidents.eu/cpcl | Includes some candidate countries |
| ACA Europe: JuriFast and Dec.Nat | Member-state decisions applying EU law, original language with EN/FR summaries | free | via e-justice.europa.eu | Narrow scope, but the English summaries make it usable without the local language |
| CURIA | Case law of the Court of Justice of the European Union | free | curia.europa.eu | Not link-checked in this pass |
| Germany: Rechtsprechung im Internet | Official portal for German federal high-court decisions | free, no registration | rechtsprechung-im-internet.de | Federal courts only. Land-level decisions are scattered across the individual state portals |
| France: Judilibre | Open-data database and API of Cour de cassation decisions, pseudonymised, mainly 1947 onward | free, public API | courdecassation.fr (API listed on data.gouv.fr) | Created by decree in September 2021. Decisions are pseudonymised, so party names are stripped: strong for law, near useless for identity |
| France: Légifrance and justicelibre.org | Consolidated French law; justicelibre.org publishes French jurisprudence without a paywall | free | legifrance.gouv.fr, justicelibre.org | justicelibre.org surfaced in this pass but was not link-checked in depth |
| Netherlands: Rechtspraak (Uitspraken) | Official Dutch case-law portal, roughly 2 million decisions, published as linked data | free, no registration | uitspraken.rechtspraak.nl | One of the most machine-readable national databases in Europe, so it is the easiest to script against |
| Belgium: Cour de cassation / Hof van Cassatie | Official Belgian supreme court case law | free | cass.be, hofvancassatie.be |
Court Records: Asia-Pacific & Commonwealth
| Resource | What it is | Access | Website | Notes |
|---|---|---|---|---|
| CanLII | Canadian court judgments, tribunal decisions, statutes and regulations from every Canadian jurisdiction | free | canlii.org | Non-profit, managed by the Federation of Law Societies of Canada. Arguably the best free national legal database anywhere and the model others copy |
| AustLII | Australasian case law and legislation, federal and state | free | austlii.edu.au (also classic.austlii.edu.au) | Run by a charitable foundation; founding member of the Free Access to Law Movement |
| NZLII | New Zealand legal materials | free | nzlii.org | |
| PacLII | Pacific Islands: American Samoa, Cook Islands, Fiji, Guam, Kiribati, Marshall Islands, Samoa, Solomon Islands, Tonga, Tuvalu, Vanuatu and others | free | paclii.org | The only free source for most of these jurisdictions, several of which turn up as offshore incorporation venues |
| HKLII | Hong Kong case law and legislation | free | hklii.hk | |
| India: eCourts Services | Official live case status, orders, cause lists and caveats across district and high courts nationwide | free | services.ecourts.gov.in | Search by CNR number, case registration number, party name, or advocate name. A genuine live docket system rather than a judgment archive, which is rare outside the US |
| India: Indian Kanoon | Free full-text search over the Supreme Court, 24 High Courts, 17 tribunals, and 1.4 million+ central laws | free | indiankanoon.org | Better for finding a judgment; use eCourts for live case status |
| Singapore: Judiciary judgments | Official written decisions and case summaries of the Singapore courts | free | judiciary.gov.sg/judgments | LawNet is the paid, fuller commercial layer |
| China: China Judgments Online | Supreme People’s Court database of judgment documents from Chinese courts, 2013 onward | free | wenshu.court.gov.cn | Searchable by case name, number, type, court, judge, party, and lawyer. Access and coverage have tightened since launch, so expect gaps and do not read one as proof of nothing |
| Japan: Courts in Japan | Official judgment search | free | courts.go.jp | Not link-checked in this pass; English coverage is partial |
Court Records: Africa, Latin America & Middle East
| Resource | What it is | Access | Website | Notes |
|---|---|---|---|---|
| SAFLII | Largest free collection of South African and wider southern African case law and legislation | free | saflii.org | |
| AfricanLII | Pan-African free legal information network | free | africanlii.org | Not link-checked in this pass |
| Brazil: Jus.br | Single national gateway for unified case search across Brazil’s courts with one gov.br login, live since December 2024 | free, gov.br login | jus.br | The most consequential recent addition for LATAM work: one search instead of court by court |
| Brazil: PJe and state portals (e-SAJ, TJSP and others) | Per-court electronic case systems | free | (per court) | Most courts still run their own public search alongside Jus.br |
| Brazil: CNJ Dados Abertos | National Council of Justice open judicial data and indicators | free | cnj.jus.br | Bulk and statistical, not per-case lookup |
| Brazil: JusBrasil | Commercial aggregator pulling case updates from 100+ Brazilian public sources including the STF and TJSP | freemium | jusbrasil.com.br | |
| UAE: DIFC Courts | Judgments and orders of the Dubai International Financial Centre common-law courts, in English | free | difccourts.ae/rules-decisions/judgments-orders | Disproportionately relevant to crypto: DIFC and ADGM are where many Gulf digital-asset disputes land, and the judgments are published in English |
Court Records: Cross-Jurisdiction & Meta
Use these when you do not yet know which jurisdiction, or when the country you need is not in the tables above.
| Resource | What it is | Access | Website | Notes |
|---|---|---|---|---|
| WorldLII | Federated free search across AustLII, AsianLII, BAILII, CanLII, CommonLII, CyLaw, NZLII, PacLII, SAFLII and HKLII | free | worldlii.org | The one-stop entry point. Returns 403 to automated fetching, so open it in a browser |
| CommonLII, AsianLII, CyLaw | Regional members of the same network (Commonwealth, Asia, Cyprus) | free | commonlii.org, asianlii.org, cylaw.org | |
| Free Access to Law Movement (FALM) | The umbrella body for the LII network; its member list is the working index of free national legal databases worldwide | free | fatlm.org | Not link-checked in this pass. This is the answer to “what about country X” when X is not listed here |
| awesome-legal-data (Open Legal Data) | Community-maintained GitHub list of legal datasets and court-decision sources by country | free | github.com/openlegaldata/awesome-legal-data | The best single list for bulk and machine-readable court data per jurisdiction |
Working a docket in a crypto case
- Pick the jurisdiction from the fiat off-ramp or the corporate entity, not from the wallet. Chain has no venue. The exchange, the shell company, or the victim does.
- Free index first, free archive second, paid pull last. PCL or WorldLII or e-Justice to locate; CourtListener, judyrecords, BAILII, CanLII to read; PACER or a court fee only when the document is not already free somewhere.
- Pull the complaint, indictment, or asset schedule, not the docket summary. Wallet addresses, exchange account numbers, and street addresses live in the exhibits. The case caption gives you almost nothing.
- Copy any address out of a filing in full, then verify it on an explorer before it enters a case file. A court document is a third-party assertion, so tag it
#unverifieduntil you have the transaction, block, and exact value from an explorer (Gate 0). - Cite case number, court, filing date, and document number. A screenshot of a docket page with no case number is not an exhibit.
- Remember PACER searches are attributable. You register under an identity and every query is billed to it. If the subject is a party who monitors their own docket, treat access as a disclosed action and plan accordingly.
Additions from Digital Detectives (Blockchain Intelligence Group with The Block Audit), ingested 2026-08-13
From the January 2025 law-enforcement guide parked at _sources/Digital-Detectives-BIG-BlockAudit-Jan2025.pdf. Vendor-published, so the QLUE feature list is the vendor’s own claim and is not independently verified here. Access tiers not link-checked in this pass.
Law-enforcement forensic platforms
| Tool | What it does | Access | Website | Notes |
|---|---|---|---|---|
| QLUE (Blockchain Intelligence Group) | Tracing and visualisation platform aimed at law-enforcement agencies: fund-flow graphs, search by address, transaction hash, or amount, real-time tracking, cross-chain tracing, address watch with alerts, and exports built for legal proceedings | paid, free trial on request | blockchaingroup.io | Vendor claims, unverified. Sales contact sales@blockchaingroup.io. Same family of capability as TRM, Chainalysis, Elliptic, positioned at LE rather than compliance teams |
VASP compliance and legal-request references
| Resource | What it is | Access | Website | Notes |
|---|---|---|---|---|
| The Block Audit legal guide | Maintained list of VASP compliance contacts and per-business requirements for verifying and submitting law-enforcement requests, including which businesses respond to a letterhead request rather than a subpoena | free | theblockaudit.com/legal-guide | Answers “will this exchange respond, and how do I address it” before you draft. Run alongside VASP Records: What to Request and What Exists. Not link-checked in this pass |
Chain-Native Block Explorers by Network
Added 2026-08-23 from REF-004 Blockchain Explorer Directory in Emilio Leb, “Cryptocurrency Investigator Operational Toolkit”, First Edition (Engardia Group, 2026), pp. 178 to 182. Fills the per-network gaps in the Blockchain section above: Etherscan, Solscan, TronScan, Mempool.space, Blockchair, OKLink, Blockchain.com and Arbiscan are already catalogued there and in the bridge section. Explorer names, URLs and features change, so confirm before relying on one. Explorer labels are helpful but not conclusive evidence without corroboration.
| Explorer | Primary chain | What it does | Access | Website | Notes |
|---|---|---|---|---|---|
| Blockstream Explorer | Bitcoin | Wallet and transaction review | free | blockstream.info | Useful second Bitcoin explorer with detailed transaction information; good cross-check against Mempool.space |
| BscScan | BNB Smart Chain | Wallets, BEP-20 tokens, contracts | free | bscscan.com | Etherscan-family interface, so the workflow transfers directly |
| PolygonScan | Polygon | Wallet, contract and token analysis | free | polygonscan.com | Etherscan family |
| Optimistic Etherscan | Optimism | Layer-2 transaction analysis | free | optimistic.etherscan.io | Etherscan family; L1 and L2 legs matter for bridge work |
| BaseScan | Base | Layer-2 wallet and transaction review | free | basescan.org | Etherscan family; increasingly common in consumer-app and token-scam activity |
Explorer capability at a glance. Transaction history is available everywhere. Token information is limited on Bitcoin explorers and extensive on EVM, Tron and Solana explorers. Smart contract review is unavailable on Bitcoin, available on EVM and Tron, limited on Solana. NFT support is absent on Bitcoin, available on EVM and Solana, limited on Tron. Internal transactions are absent on Bitcoin, available on EVM, limited on Tron, and network-dependent on Solana.
Additions from litigation-methodology sources, ingested 2026-08-23
From Captura Cyber, “Cryptocurrency Tracing Methods: The Litigators Guide” (capturacyber.com, retrieved 2026-08-23), knowledge-base/_sources/cryptocurrency-tracing-methodology-captura-cyber-2026.pdf. Every other platform named in that source (Chainalysis Reactor, Elliptic Investigator, TRM Labs, Breadcrumbs, Arkham, GraphSense, Blockchair, Etherscan) is already catalogued above. Read alongside Three Functions of Forensic Tooling: in litigation the tool has to be chosen for the task and the admissibility bar, not for what you already have a licence to.
| Tool | What it is | Access | Website | Notes |
|---|---|---|---|---|
| CipherTrace | Blockchain analytics and tracing platform, now part of Mastercard | enterprise | ciphertrace.com | Named alongside Chainalysis and Elliptic as one of the platforms most likely to appear in litigation. Same black box caveat: the attribution is proprietary, so a label needs independent corroboration before it becomes a finding |
| Learn Me A Bitcoin | Reference site explaining Bitcoin internals (transaction structure, UTXOs, keys, script types, Taproot) with worked byte-level examples | free | learnmeabitcoin.com | Not an investigation tool, a translation tool. The place to go when a report has to explain what a UTXO or a script type actually is to a non-technical reader, and the fastest route to understanding a transaction you are reading raw |
Additions from international-guidance sources, ingested 2026-09-14
From three ingested sources: Alexander Browder, “Confronting the Illicit-Finance Hydra in Crypto Markets” (Henry Jackson Society / Centre for Resilient Society, March 2026); GAFILAT, “Guide on Relevant Aspects and Appropriate Steps for the Investigation, Identification, Seizure, and Confiscation of Virtual Assets” (December 2021); OSCE Mission to Skopje / Academy for Judges and Public Prosecutors, “Handbook for Dealing with Virtual Currencies in Criminal Proceedings” (Ristoska & Veternik, undated, cites legislation to late 2021). Source PDFs in knowledge-base/_sources/. Every other platform named across the three (Chainalysis, Elliptic, TRM Labs, Maltego, Shodan, Namechk, TinEye, and the T3 Financial Crime Unit) is already catalogued above.
| Tool | What it is | Access | Website | Notes |
|---|---|---|---|---|
| Coin ATM Radar | Global map and directory of crypto ATMs and kiosks, searchable by area and by operator, with fees and supported assets | free | coinatmradar.com | The enumeration step in Working a Crypto ATM as a Physical Pivot. Lets you list the candidate machines in an area before you have a single transaction, which is what makes a records request to the operator scopeable. Listings are operator-supplied and go stale, so confirm the machine exists before building a surveillance plan around it |
| WalletExplorer | Bitcoin address clustering service that groups addresses into named wallets and labels many exchanges and large services | free | walletexplorer.com | Useful free cross-check on a commercial platform’s clustering for Bitcoin. Its labels and clusters are its own and it has not been meaningfully maintained for years, so treat it as a lead generator rather than a source. Never carry a WalletExplorer label into a finding without independent corroboration |
| Basel Open Intelligence | Open platform from the Basel Institute on Governance covering money laundering and terrorist financing risk by country, with the Basel AML Index | free, registration | baselgovernance.org | Jurisdiction risk context for scoping and for the risk paragraph of a report. Country-level risk, not entity-level: it tells you what kind of counterparty environment you are in, and nothing about the specific service in front of you |
| Dark.fail / TNO Dark Web Monitor | Dark.fail is a verified-mirror index of onion services; the TNO Dark Web Monitor is a research-grade darknet monitoring platform used by law enforcement | dark.fail free, TNO restricted | dark.fail | Named in the GAFILAT guide as routes into darknet market infrastructure. Do not open either from this workspace. Onion indexes sit squarely inside the never-open-an-investigation-URL rule, and dark.fail’s whole function is resolving addresses for services you should only reach from a designated isolated environment. Use for naming a market, not for reaching one |
| EJCN Virtual Currencies Guide / Europol VASP contact list | Guidance from the European Judicial Cybercrime Network plus a Europol-maintained contact list of exchanges and compliant entities for law enforcement and judicial authorities | restricted, law enforcement and judiciary only | europol.europa.eu | The practical answer to “who do I actually write to, and is this service real”. The contact list is the counter-measure to Approaching a VASP Can Tip Off the Target: it tells you whether the service has a genuine compliance function before you send anything. Access runs through a national single point of contact, not through the public site |
Additions from the Cryptocurrency Investigator Playbook, ingested 2026-09-21
Official Reporting & Escalation Portals
Where a matter goes once it leaves your desk. From Emilio Leb, “Cryptocurrency Investigator Playbook”, First Edition (Engardia Group, June 2026), section 7.8 Resource Links and Reference Portals p. 68; knowledge-base/_sources/crypto-investigator-playbook-leb-2026.pdf. Chainabuse, OFAC SDN Search, Chainalysis, TRM Labs and Elliptic already appear above and are not repeated. Agency pages, intake portals and contact procedures change, so verify the URL before submitting anything sensitive. These are official agency sites and fall under normal research, unlike an investigation or episode URL, which is never opened from this workspace.
| Portal | What it is for | Access | Website | Notes |
|---|---|---|---|---|
| FBI IC3 | US internet crime and crypto-fraud complaint intake | free | ic3.gov | The default destination for a US victim complaint. A filed IC3 complaint gives the matter a federal reference number, which is worth having before you approach a service. Intake only: filing does not open an investigation and generates no response you can rely on |
| FBI Cryptocurrency Investment Fraud | Victim guidance and reporting direction | free | fbi.gov | Hand to a victim rather than working from it yourself. Useful for setting expectations early, which is most of victim management |
| FinCEN | AML resources, BSA guidance, advisories, and SAR context | free | fincen.gov | Source of record for advisories and their key terms. Where the SAR narrative structure and the CVC advisory FIN-2019-A003 come from. See “The FinCEN SAR Narrative Structure” (05-evidence-legal) |
| SEC Crypto Assets | Investor protection and crypto enforcement resources | free | sec.gov | Route for a securities-fraud pattern. Relevant where a platform made investment representations, which most fake trading platforms do |
| CFTC Digital Asset Frauds | Digital commodity fraud and market manipulation resources | free | cftc.gov | Route where the product is framed as commodity trading, futures, or leveraged crypto |
| Europol EC3 | European Cybercrime Centre coordination reference | reference; operational access via national units | europol.europa.eu | Reference point rather than an intake desk. Operational routing runs through a national single point of contact. The EJCN guide and Europol VASP contact list are listed separately above |
| INTERPOL Financial Crime | International financial crime and anti-corruption coordination | reference; operational access via national bureaus | interpol.int | Same shape as EC3: you reach it through your national central bureau, not directly |
| FATF Virtual Assets | Global AML and CTF standards and virtual-asset guidance | free | fatf-gafi.org | Standards and jurisdiction context, not a reporting route. The source for Travel Rule framing and the high-risk jurisdiction lists |
Related
Use a Suite of Tools, Not One · Blockchain Explorer Review Procedure · Blockchain Network Comparison Matrix · PI Response Priority: Freeze, Monitor, Predict, OSINT · Freezing Funds with an Exchange Email · Cooperating Instant Exchanges as Pivot Points · Time-and-Value Analysis · Decoding a Cross-Chain Destination Address from Input Data · Obsidian Case-Management Workflow · Intelligence Discipline Taxonomy · Working with Law Enforcement: Capacity, Speed, and Cross-Sector Coalitions · Monitoring Addresses with Alerts · Operational Tracing Runbook: Live Mixers Bridges and No-KYC Swaps
Last updated on