{"id":423,"date":"2020-01-23T23:48:40","date_gmt":"2020-01-23T23:48:40","guid":{"rendered":"https:\/\/osintme.com\/?p=423"},"modified":"2020-04-16T21:17:57","modified_gmt":"2020-04-16T21:17:57","slug":"osint-me-tricky-thursday-3","status":"publish","type":"post","link":"https:\/\/osintme.com\/index.php\/2020\/01\/23\/osint-me-tricky-thursday-3\/","title":{"rendered":"Osint Me Tricky Thursday #3 – Bitcoin"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The focus of today’s Tricky Thursday is OSINT and Bitcoin – how to identify Bitcoin addresses, wallets, transactions, users and their associations.<\/p>

Bitcoin (BTC) entered the realm of global mainstream focus after its parabolic growth in 2017 – so I assume you are at least somewhat familiar with it, what it is, what it does and how it can be useful.<\/p>

If not, then check out some of these educational resources to read \/ watch \/ listen about Bitcoin:<\/p>

The Bitcoin Standard – book by Saifedean Ammous<\/a><\/p>

Bitcoin Information & Resources – by Jameson Lopp<\/a><\/p>

The What Bitcoin Did Podcast – by Peter McCormack<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Bitcoin is used as a means of exchange and a store of value by many shady actors, from money launderers and drugs dealers to terrorists and even spy agencies.<\/p>

Bitcoin is not completely anonymous however and the Bitcoin blockchain is one of the underused and underrated OSINT tools out there.<\/p>

So let’s check out some OSINT tricks:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

BLOCKCHAIN EXPLORER<\/strong> – https:\/\/www.blockchain.com\/explorer<\/a> – a great start to bitcoin transaction analysis, it provides a glimpse into the activity on the Bitcoin network.<\/p>

Allows you to search for a particular bitcoin address, transaction hash, or block number.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

WALLET EXPLORER<\/strong> – https:\/\/www.walletexplorer.com<\/a> – it’s a Bitcoin block explorer with address grouping and wallet labelling functions. Searching for one or several Bitcoin addresses might allow you to identify a specific wallet they belong to.<\/p>

Let’s take this BTC address – 16JAUnuvxQ6BdfX4DwsEVTWgd3a8oitu8h<\/p>

Using the Wallet Explorer you can group and analyse transactions and other addresses that have been positively identified as belonging to the one and the same wallet, in this case [001e0c6430].<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
.<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

LOCAL BITCOINS<\/strong> – https:\/\/localbitcoins.com<\/a> – the most popular peer-to-peer Bitcoin exchange with a global reach. You can find Bitcoin sellers and buyers operating in your area and using various payment methods.<\/p>

Useful information readily available includes a person’s nickname, language spoken, recent activity and more.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

INTELLIGENCE X<\/strong> – https:\/\/intelx.io<\/a> – not specific to Bitcoin and blockchain, but very useful at searching for any open source of intelligence pertaining to BTC addresses, wallets, transactions, websites, usernames etc.<\/p>

For instance, searching for this Bitcoin address 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw reveals some interesting associations:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

WannaCry Malware Profile FireEye<\/a><\/h4>

51<\/p><\/div><\/div>2017-05-26 09:37:07<\/div><\/div>

Full Data<\/a><\/div>
May 23, 2017 | by Alex Berry, Josh Homan, Randi Eitzman | Threat Research\nWannaCry (also known as WCry or WanaCryptor) malware is a self-propagating (worm-like) ransomware that spreads through internal networks and over the public internet by exploiting a vulnerability in Microsoft\u2019s Server Message Block (SMB) protocol, MS17-010. The WannaCry malware consists of two distinct components, one that provides ransomware functionality and a component used for propagation, which contains functionality to enable SMB exploitation capabilities.\n\nThe malware leverages an exploit, codenamed \u201cEternalBlue\u201d, that was released by the Shadow Brokers on April 14, 2017.\n\nThe malware appends encrypted data files with the .WCRY extension, drops and executes a decryptor tool, and demands $300 or $600 USD (via Bitcoin) to decrypt the data.<\/pre><\/div>
WannaCry Bitcoin Addresses<\/a><\/h4>
51<\/p><\/div><\/div>2017-05-21 12:40:55<\/div><\/div>
Full Data<\/a><\/div>
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94<\/pre><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
OXT<\/strong> – https:\/\/oxt.me<\/a> – a platform that provides a variety of interactive charts, histograms, info pages for blocks and addresses allowing for analysis and filtering of transactions.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
BITCOIN WHO’S WHO<\/strong> – https:\/\/bitcoinwhoswho.com<\/a> – another OSINT resource where BTC users can tag addresses with specific information.<\/p>
Very useful for detecting and labelling addresses associated to scams, ransomware, sextortion and other illegal activities identified by users worldwide.\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
BITCOIN RICH LISTS<\/strong> – these resources allow you to track and in some cases attribute BTC “whale” addresses to particular entities, like online exchanges.<\/p>
NOTE: After the notable seizures of Bitcoin associated with criminal activities, the FBI’s Bitcoin addresses featured several times among the largest holders of Bitcoin!<\/em><\/p>
https:\/\/bitinfocharts.com\/top-100-richest-bitcoin-addresses.html<\/a><\/p>
https:\/\/btc.com\/stats\/rich-list<\/a><\/p>
\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
… and finally, the Good Old Uncle Google!<\/strong><\/p>
Google search engine does a great job of matching Bitcoin addresses to dates, transactions, specific amounts and so on.<\/p>
If you know the exact amount of Bitcoin you want to track but don’t know exact dates of the transaction or other variables, you can Google this exact BTC amount followed by search parameters like the date (YYYY-MM-DD format) and the URL.<\/p>
Example:<\/strong><\/span><\/p>
“0.01180489 BTC” AND “2020-01-19” inurl:blockchain<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
So that’s it!<\/strong><\/h4>
PS: As a user and advocate of Bitcoin I could not resist and throw my own BTC address into the mix!<\/em><\/h4>
1HKjMa3Nw8HoDZGJhXPLRNxiv4iQPpfqb1<\/strong><\/h4>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"
How to identify Bitcoin addresses, wallets, transactions, users and their associations<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6],"tags":[62,64,63,65,44,14,26],"class_list":["post-423","post","type-post","status-publish","format-standard","hentry","category-open-source-intelligence","tag-bitcoin","tag-blockchain","tag-btc","tag-cryptocurrency","tag-intelligence","tag-privacy","tag-tricky-thursday"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/423","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/comments?post=423"}],"version-history":[{"count":7,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/423\/revisions"}],"predecessor-version":[{"id":709,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/423\/revisions\/709"}],"wp:attachment":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/media?parent=423"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/categories?post=423"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/tags?post=423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}