Using publicly available sources of information to deanonymize cryptocurrency wallets

Teacher

Professional
Messages
2,677
Reputation
9
Reaction score
632
Points
113
From a legal point of view, cryptocurrency can be defined as property in electronic form, created using cryptographic means, and recorded in the distributed register of digital transactions in accordance with the established rules for its maintenance.

From a technical point of view, cryptocurrency is a distributed, open-source peer-to-peer virtual currency based on mathematical principles, which does not have a centralized administrator, as well as appropriate control and supervision by government agencies or other third parties.

Cryptocurrencies have significant differences from the usual financial transactions. They do not require a centralized regulator or issuer. At the same time, all cryptocurrency transactions are public and recorded in a special register - the blockchain. At the same time, there is no data on the actual owner of a particular cryptocurrency wallet in the blockchain. It is anonymous, and actually has the ability to create an unlimited number of unique addresses to the wallet.

The existing methodology for deanonymizing cryptocurrency transactions involves tracking the entire chain of their execution from the moment of the payment under study to the intended exchange of cryptocurrency for "fiat money" through cryptocurrency exchanges, in an exchanger or ATM.

To collect data about crypto wallets and track their transactions, you can use regular blockchain browsers:
  • btc.com
  • etherscan.io
  • xrpcharts.ripple.com/#/graph
  • explorer.bitcoin.com/bch
  • litecoinblockexplorer.net
  • steexp.com

As well as universal browsers:
  • blockchair.com
  • tokenview.com
  • blockchain.com
  • bitaps.com
  • live.blockcypher.com

The latter make it possible to conduct a more thorough analysis and study several cryptocurrencies in one service. Browsers store the following information about completed transactions:
  1. date and time of the transaction
  2. addresses of the sender's and recipient's cryptocurrency wallets
  3. amount of cryptocurrency transferred
  4. transaction fee and hash (which serves as proof of the transaction and is used to verify it)
The disadvantages of such browsers include: the lack of built-in systems for visual representation and analysis of transactions, the inability to set up a cryptographic wallet for monitoring (tracking), and the inability to automatically assign the studied cryptographic wallets to known entities (individuals, projects, exchanges, mixers, etc.).

e2f42f002d1dba79fc8b0adfa9cb2437.jpg


Some of these shortcomings can be offset by using free software. So the visual representation of cryptocurrency transactions can be organized using the services:
  • sicp.ueba.su
  • graphsense.info
  • blockpath.com
  • c-hound.ai
  • oxt.me
  • repository github.com/s0md3v/Orbit
The Maltego software package used in our company is also suitable for such studies. Tracking the activity of crypto wallets is possible using solutions such as: cryptocurrencyalerting.com/wallet-watch.html or cryptotxalert.com.

08ff4f06912960406c72a4548bc3b4f4.png


Now that we know how to organize transactions in a virtual environment, we need to move on to studying the question of assigning each specific crypto wallet to known entities.

The first thing that comes to mind here is the use of regular Google search capabilities. Proof of ownership of a crypto wallet can be provided by specifying the address of a cryptocurrency wallet as a payment system on a website, social network, messenger, blog, or forum. Such data can be detected by Google's search engines.

Of particular interest is the use of Google Dorks.

For example, the search query [url_cryptocashel -block] allows you to clean up the output, excluding most of the blockchain browsers from it.

Request for [site:bitcointalk.org address_cryptoshelka] allows you to search for information about the cryptoshelka on the selected site.

Request for [site:https://docs.google.com/spreadsheets Bounty intext: "@gmail.com"] makes it possible to find lists of identified crypto wallets involved in Bug Bounty programs.

cf22d55a83ce07cb307574839f6c459c.png


The use of search engines allows us to find a link between the address of a cryptocurrency wallet and other identifiers that may be useful for identifying its user.

These identifiers include:
  • first name or nickname
  • email address
  • phone number
  • user id in a social network or messenger
  • photo
  • site address
  • other digital assets, etc
You can search for matches by name in the service go.mail.ru/search_social, by nickname in: t.me/maigret_osint_bot or whatsmyname. app.

You can identify a user's photo by clicking on the following links:
  • findclone.ru
  • search4faces.com

c09b31d572d9a67c03574ea19542214d.jpg


Identification of contacts of site owners and domain names is possible when using sites such as:
  • domainbigdata.com
  • phonebook.cz
  • mailshunt.com
  • hunter.io

WHOIS data, including archived data, is available on the following resources:
  • whois.domaintools.com
  • drs.whoisxmlapi.com/whois-history

7dd83545a50051592855f25fb891470d.png


Ad ID analysis - using the following services:
  • spiderfoot.net
  • themarkup.org/blacklight
  • urlscan.io
  • spyonweb.com
  • dnslytics.com/reverse-analytics

80dce92600cae0d8880a5315edb6555d.png


The mobile phone number and email address of the cryptoasset owner can be identified using the TelPoisk, Infosphere, NEO, Prima Inform, IDX, Spectrum Data and a number of other services.

Further information about crypto wallets should be searched on otzoviki.

They are interesting because they aggregate data about the use of wallets in illegal activities. These services include:
  • bitcoinabuse.com
  • bitcoinwhoswho.com
  • checkbitcoinaddress.com
  • cryptscam.com
  • scam-alert.io

927ed87c9425d4111475f618fcd211ad.jpg


In part, we can also refer to the service as "otzoviki" bitrankverified.com, which allows you to conduct a scoring assessment of the cryptographic wallet.

And you can check whether a crypto wallet belongs to an exchange, exchanger, or other entity using resources such as:
  • walletexplorer.com
  • bitinfocharts.com
  • oxt.me
Finally, it is worth noting that the detection of exchanges and exchangers in transaction chains is extremely important, since under the KYC/AML procedure (AML/CFT in Russia), crypto exchanges have committed themselves to identify their users and transmit information about them upon a reasoned request from law enforcement agencies or the court.

habrastorage.org
 
Top