Assume every action might be seen. The four layers of managed attribution: a separated identity (sock-puppet research accounts, never linked to the real you); an isolated machine (a dedicated VM or Tails, or at minimum a separate browser profile); an anonymized network (a reputable VPN, or Tor when stakes are high); and disciplined behavior (never log into a personal account, never click a subject-controlled link from your real browser, watch for read receipts and view notifications). The failures that burn investigators are almost always behavioral, not technical. Authorized, public-source work only.
Update — October 2026
What changed since this guide was last revised (30 July 2026). Every item below was re-checked on 8 October 2026:
- Age checks now meet sock puppets. Since 25 July 2025, UK services that allow pornography or certain harmful content must use "highly effective" age checks. Ofcom (24 Jul 2025) Since 10 December 2025, Australian age-restricted social platforms must take "reasonable steps" to stop under-16s holding accounts, and the eSafety Commissioner says self-declared age alone is not enough. eSafety Commissioner In practice (our assessment), a persona may now be asked for a face scan or ID document. Never put your real face or ID behind a research persona, because that ties the persona to you.
- Fingerprinting got more common in ads. From 16 Feb 2025 Google lifted its ban on device fingerprinting for organisations using its advertising products, and the UK ICO called the change "irresponsible". DLA Piper (Jan 2025) Expect more sites to recognise a returning browser even with cookies cleared, which makes separate browser profiles per persona more important, not less.
- Fingerprinting defences also got better. Firefox 145 (Nov 2025) added protections that Mozilla says cut the share of users seen as unique by fingerprinters "by almost half". They are on in Private Browsing and Enhanced Tracking Protection Strict mode first. Mozilla (10 Nov 2025) Tor Browser remains the strongest uniform-fingerprint option. Its current stable release is 15.0.25 (12 Oct 2026), and Tails is at 7.15 (13 Oct 2026). Tor Project
- Proxy rotation now carries legal risk. In 2026 US courts treated spoofing fingerprints, rotating IPs and solving CAPTCHAs to get past an anti-bot system as possible DMCA circumvention. Residential proxies are for blending in on open pages, not for defeating a block. See Is OSINT legal? (October 2026 update).
- Your own exposure. If you are researching ALPR or Flock deployments, remember those cameras log the investigator's car too. See the Flock guide and ALPR and the 2026 midterms. If you hand searches to an AI agent, the agent's network egress is part of your attribution surface: see the AI-agent OSINT guide.
- 16 Oct 2026 — a maintained investigation VM. The Trace Labs OSINT VM 2026.10 adds an apt repository and a QubesOS template. See Layer 2.
The leak you don't see
Most people picture OSINT as passive — you're just looking. But looking leaves traces. Query a subject's own web server, mail server, or API directly and your IP address sits in their logs, timestamped. View a LinkedIn profile and, depending on settings, they get told your name. Open an Instagram or Signal story, or send anything at all, and read receipts and view counts fire. Worst of all, click a link the subject planted — a shortened URL, a tracking pixel, a canary token — and you've handed over your IP, browser, operating system, and rough location in one request. A sophisticated subject can watch for exactly this. The first rule of investigative OpSec is simple: assume you are being watched, and route around it.
Managed attribution: the concept
Managed attribution means deciding, deliberately, what your activity reveals about you — and making it point at a research persona or at nowhere in particular instead of at your real identity, your employer, or your home city. Commercial platforms sell this as a service (isolated cloud browsers with non-attributable exit points), but you can assemble the essentials yourself. Think of it as four layers that stack; a gap in any one can undo the others.
Layer 1 — Identity: sock-puppet accounts
A sock puppet is a pseudonymous research account kept completely separate from your real identity. Done right, it has its own email, its own phone number for verification, a plausible and slowly-aged history, and no follow, like, or profile detail that ties back to you. Done wrong — created five minutes ago, reused across cases, or linked to your real phone — it's worse than nothing, because it signals "investigator." Age-assurance rules (UK since July 2025, Australia since December 2025) mean some platforms may now ask a persona for a face scan or ID. Treat that as a hard stop rather than a hurdle, because it links the persona to your real identity. Keep sock puppets for observing public content; never use them to trick someone into private disclosures without authorization, and know that pseudonymous accounts usually breach a platform's terms of service even when they're perfectly legal.
Layer 2 — Machine: isolation
Keep research off the device that holds your real life. The strongest options are a dedicated virtual machine you can snapshot and roll back, or a live operating system such as Tails that leaves nothing behind. If that's too heavy for routine work, the minimum viable step is a separate browser profile (or a container/incognito discipline) that never touches your personal logins, extensions, or autofill. The goal is no crossover: no shared cookies, no shared sessions, no "stay signed in." For juggling several research personas at once, a dedicated anti-detect browser such as Incogniton affiliate takes this further: each profile carries its own isolated cookies, storage, and browser fingerprint, so two sock puppets do not share a detectable signature (vendor claim; test it on our exposure checker). This matters more since Google began allowing fingerprinting in its ad products in February 2025.
Research phone? A dedicated Android phone keeps sock-puppet apps off your personal device. GrapheneOS, which our phone forensics guide covers, installs from an official WebUSB web page in Chrome, Edge or Brave with Shields off, and can even be installed from a second Android phone GrapheneOS web installer (read 23 Oct 2026). Treat unknown USB cables and chargers as untrusted too: our USB Device Inspector shows whether a “charging cable” is really a keyboard.
Want a ready-made research VM? The free Trace Labs OSINT VM (GPL-3.0, maintained by Trace Labs staff) comes as VirtualBox and VMware images, plus an ARM64 image for Apple silicon tlosint-vm on GitHub (read 16 Oct 2026). Release 2026.10, out on 14 Oct 2026, added an apt repository at apt.tracelabs.org, so most of the toolset installs as one package, tlosint-meta. It also added a template for QubesOS (an operating system that runs each task in its own isolated VM). Tools now have to run on both arm64 and amd64, follow the platform's terms of service and be actively maintained Trace Labs (14 Oct 2026).
The apt packages are built for Debian 13 (trixie) on amd64. Check the signing key's fingerprint against the one published on the repository page before you add it apt.tracelabs.org (read 16 Oct 2026). The prebuilt image ships with the login osint / osint tlosint-vm on GitHub (read 16 Oct 2026), so change it on first boot. Then take a clean snapshot to roll back to after each case. A VM separates your research from your personal machine, but it does not hide your IP address: Layer 3 still applies.
Layer 3 — Network: anonymized egress
Your IP is identity. For most authorized research, a reputable VPN plus the isolation above keeps your real address out of a subject's logs. When the subject is sophisticated or the stakes are high, Tor adds stronger anonymity — at the cost of speed and of some sites blocking Tor exits. Datacenter IPs are easy to flag as "not a normal visitor," so managed-attribution services offer residential exits; weigh whether that realism matters for your case. For collecting public data at scale without tripping blocks, a residential proxy network such as Bright Data affiliate routes each request through a real residential IP, so a target sees ordinary visitors rather than one datacenter address hammering the site (vendor capability). One caution from 2026: using rotating IPs or fingerprint spoofing to get past an anti-bot wall has been treated by US courts as possible DMCA circumvention. Blend in, but do not break in — see the legal page. Whatever you choose, verify there's no leak (DNS, WebRTC) before you begin.
Researching onion services or subjects who use Tor? The Tor and Onion OpSec guide covers Tor Browser security levels, bridges, Tails vs Whonix, download leaks and how real operators were identified.
Layer 4 — Behavior: query hygiene
This is where careful people still get caught. Never log into a personal account in the research environment. Never click a subject-controlled link from your real browser — copy it into an isolated session, or view it through an archive or a preview service. Turn off read receipts; don't view stories you don't want counted; remember that presence shows in shared documents. Pull from caches and archives (the Wayback Machine, search caches) instead of hitting the live target when you can. And use passive sources: the AI dorks here are written to fetch from public registries and archives rather than probe the subject directly.
Watch the friend suggestions. If you study a profile for hours while logged in as yourself, Facebook or LinkedIn may suggest your account to the person you are studying. OCCRP's research team gives that warning, and adds that one accidental like on a criminal's profile could be dangerous. A persona also has to look real to survive fake-account filters, LinkedIn's above all. Give it a matching email address and a job or hobby, and post now and then. OCCRP, Shaya Laughlin (17 Sep 2026)
Look for the weakest link. A subject with a private account often has relatives or friends who post in public. OCCRP found a scammer's villa through photos his wife posted. Observe those accounts the same way: from the persona, without interacting. OCCRP, Shaya Laughlin (17 Sep 2026)
The Max Intel irony — and how to use these tools safely
Worth saying plainly: many tools on this site build a link that your browser then sends to a third party — and some of those queries reach services the subject can see, carrying your IP and, implicitly, your interest. That's inherent to browser-based OSINT, not unique to us. Use the layers above: run the direct-query tools from an isolated, VPN'd session; prefer the passive lookups (archives, certificate transparency, RDAP, the AI dorks) when you only need public data; and log what you do in the Evidence Logger so your methodology is defensible. Keep exported notes and evidence encrypted at rest — an end-to-end-encrypted store such as pCloud or Proton Drive affiliate links means a lost laptop or a breached inbox doesn't hand over your case file. The Pivot Hub is best driven from that same clean environment.
Legal and ethical lines
Managed attribution protects you; it doesn't license anything. Keep to authorized, public-source work. Pseudonymous accounts are for passive observation, not for deceiving people into disclosures or for anything resembling entrapment. Don't use these techniques to stalk, harass, or surveil people without authorization — the same tradecraft that protects a journalist protects an abuser, and the difference is entirely in the purpose and the authorization. When a case is sensitive, get legal guidance before you start.
Pre-investigation OpSec checklist
Work through this before you open the first tool. Your progress is saved in this browser only.
Frequently Asked Questions
Can the person I'm investigating tell that I'm looking?
Often yes — direct queries land in their logs, profile views can notify them, stories and messages trigger read receipts, and a subject-controlled link logs your IP and browser. Good OSINT assumes observation and routes around it; that's what managed attribution is for.
What is managed attribution?
Controlling what your activity reveals about you — making it point at a research persona or nowhere, not at the real you. Four layers: separated identity (sock puppets), isolated machine (VM/Tails/separate profile), anonymized network (VPN/Tor), and disciplined behavior (query hygiene).
Are sock-puppet accounts legal?
Pseudonymous research accounts are legal in most places and standard for journalists and investigators, but usually breach platform terms of service. They become a legal problem when used for fraud, harassment, unauthorized access, or entrapment. Keep them for passive observation of public content.
Do I need Tor, or is a VPN enough?
For most authorized research, a reputable VPN affiliate plus an isolated browser profile keeps your IP out of a subject's logs. Tor adds anonymity when stakes are high, at the cost of speed. The bigger risks are behavioral — personal logins, subject-controlled links — not the network layer.
Will a platform ask my sock puppet for ID or a face scan?
Increasingly, yes, depending on the country and the content. Since 25 July 2025, UK services that allow pornography or certain harmful content must use highly effective age checks. Since 10 December 2025, Australian social platforms must take reasonable steps to keep under-16s off, and self-declared age is not enough. A research persona can therefore hit a face-scan or ID prompt. Never complete one with your real face or documents, because that ties the persona to you. Choose a different collection route, or work from a jurisdiction and account type where the check does not apply.
Is using residential proxies for OSINT legal?
Using a proxy to browse open pages is generally lawful, but using rotation to defeat a block is now a legal risk in the US. In 2026 federal courts treated IP rotation, fingerprint spoofing and CAPTCHA-solving used to get past an anti-bot system as possible circumvention under DMCA §1201, at least where the wall protects copyrighted content. Use proxies to avoid exposing your own IP, not to break through a site's defences, and read our legal guide before any large-scale collection.