By Elena Dollfuss, Data Researcher, ORYXLABS
In OSINT, information is power – but only if you remain invisible while collecting it. The moment a target becomes aware of your presence, the investigation risks compromise. Protecting your identity is not just a precaution; it’s the foundation of operational security.
In the first post of this series, we explored why protecting your identity is critical during investigations. This new post focuses on the best practices that allow investigators to remain anonymous while gathering intelligence effectively. We shift to the what: the tools and practices that help you collect intelligence while remaining unseen.
To conduct OSINT effectively, you need a multi-layered approach to privacy, minimising your exposure at every step. You must build a fortress around your identity, digital brick by digital brick.
1. Mask your IP address: your digital disguise
Your IP address is your digital front door. It reveals where you are, who provides your internet, and sometimes even your organisation. Exposing it during an investigation compromises your position before the investigation even begins. There are three primary methods to protect your IP address when navigating online:
- No-logs VPNs (e.g., Mullvad, ProtonVPN): Use a reputable Virtual Private Network (VPN) with a strict no-logs policy to encrypt your traffic and hide your real IP. Think of these as secure couriers that deliver the message without revealing the sender.
- Tor network: For the highest level of anonymity, route your traffic through the Tor network. Although slower, the multi-layered encryption makes it significantly harder to trace your activity back to you.
- Check for DNS leaks: Always verify your IP masking using tools like dnsleaktest.com to ensure your DNS requests aren’t bypassing your security measures.
Masking your IP address is the first layer of anonymity, keeping your investigation invisible from the outset.
2. Compartmentalise: keep investigations separate
Mixing personal browsing with OSINT tasks is one of the most common and damaging mistakes an investigator can make. It’s akin to using the same notebook for classified notes and grocery lists – eventually something important will land in the wrong place.
To avoid leaving digital fingerprints that tie investigations back to you, compartmentalisation is key. Some methods include:
- Virtual Machines (VMs): Running OSINT sessions in isolated environments. For instance, Whonix routes all traffic through Tor; Kali Linux provides a powerful toolkit for investigators; and Tails offers ephemeral sessions (sessions which once closed, seem like they never happened). These tools act as separate, secure workspaces for each investigation.
- Firefox multi-account containers: For a lighter approach to isolation, this Firefox feature separates browsing sessions by target, preventing cookies and trackers from leaking across investigations.
This practice ensures that work from one case never contaminates another.
3. Defend against fingerprinting: more than just cookies
As discussed previously, websites can recognise you even without cookies, by using the unique combination of your browser settings, system details, and behaviour. To block the “fingerprint” that makes you traceable across sessions, there exist dedicated anti-fingerprinting tools, with robust tracker blockers that offer comprehensive protection:
- Browser-spoofing tools: These tools make your browser look like something else entirely. Canvas Defender and CanvasBlocker distort how websites “see” your browser, while Chameleon and User-Agent Switcher can automatically change your browser’s visible traits, such as your User-Agent, time zone, and language.
- Tracker and ad blockers: Extensions like uBlock Origin and Privacy Badger block a wide range of trackers and ads, which are often used to build a profile of your online behaviour.
- Cookie management: Cookie AutoDelete automatically clears cookies when you close a tab, preventing long-term tracking and ensuring no traces are left behind.
These tools act like camouflage, ensuring your “digital outfit” changes before anyone can recognise you.
4. Test your defences: confirm everything’s working
Anonymity isn’t a one-time setup; it’s an ongoing process. Even the best tools are useless if they don’t function as intended, so you must always verify that your protections are actually working.
- AmIUnique: Shows how unique (and therefore trackable) your browser fingerprint is.
- EFF’s Cover Your Tracks: A comprehensive tool by the Electronic Frontier Foundation to assess your defences against tracking and fingerprinting.
- BrowserLeaks: Provides detailed tests for WebRTC leaks, Canvas fingerprinting vectors, HTTP header exposures, and more.
Treat this as your regular “operational health check”. Just like a soldier inspects its gear before a mission, always inspect your digital defences.
Common mistakes to avoid
Even with the best tools, one small slip can compromise your anonymity:
- Logging into personal accounts: Never use the same browser or profile for OSINT as you do for your personal online activities.
- Forgetting to disable WebRTC: WebRTC (Web Real-Time Communication) can sometimes leak your real IP address even when you’re behind a VPN.
- Failing to rotate fingerprints or clear session data: Between different targets or investigations, ensure you clear all session data and, ideally, rotate your spoofed fingerprint.
- Downloading files without sanitising metadata: Files often contain hidden metadata (EXIF data in images, document properties) that can reveal details about your device or location. Use tools like exiftool to remove it.
Operational discipline is as important as the tools themselves. Cut corners and find yourself exposed; or embrace the hassle and enter the digital space protected and focused.
Closing thoughts
Anonymity in OSINT is never the result of a single tool; it is the outcome of layers of protection working together. A VPN or Tor masks your location, but it is meaningless if your browser fingerprint remains unchanged. Tools like Chameleon and Canvas Defender obscure your unique traits, but they only work effectively when combined with tracker blockers such as uBlock Origin. Compartmentalisation through VMs and Firefox Multi-Account Containers ensures one investigation never contaminates another, while tools like Cookie AutoDelete and exiftool clean up the traces you leave behind.
Each measure on its own reduces exposure, but together they form a comprehensive shield that keeps your presence invisible and your investigation uncompromised.
Managing multiple tools can be complex. This is where DISCOVERY, our external attack surface management and digital risk protection solution, steps in. DISCOVERY provides continuous situational awareness, vulnerability assessments and threat intelligence monitoring. For investigators, it offers a streamlined way to safeguard anonymity and conduct asset mapping without juggling a dozen separate tools.
With the right practices, and DISCOVERY as your ally, you can collect intelligence safely, effectively, and without leaving a trace.
Ultimately, your goal is simple: stay vigilant, stay anonymous.