> For the complete documentation index, see [llms.txt](https://docs.intelligenceonchain.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.intelligenceonchain.com/spectra-the-in-browser-detective/readme.md).
# Spectra - Complete Guide
### Introduction
Spectra is an investigation platform that runs entirely in your browser. It brings together two disciplines that usually live in separate tools: **on-chain tracing** — following value across hops, through instant exchanges and around mixers — and **open-source intelligence** — the work of connecting an address to a person.
There are twelve modules. They share one evidence model, so a finding in one is usable in the next without re-keying anything.
{% hint style="info" %}
**New here?** Skip to [Your first investigation](#your-first-investigation) and come back. The fastest way to understand Spectra is to run one search against an address you already know something about.
{% endhint %}
***
### Contents
1. [Getting access](#getting-access)
2. [How credits work](#how-credits-work)
3. [Your first investigation](#your-first-investigation)
4. [The modules](#the-modules)
5. [Tornado Cash analysis](#tornado-cash-analysis)
6. [Workflows](#workflows)
7. [Reading the output](#reading-the-output)
8. [Methodology](#methodology)
9. [Exporting and case management](#exporting-and-case-management)
10. [Troubleshooting](#troubleshooting)
11. [Glossary](#glossary)
***
### Getting access
Spectra lives at [spectra.intelligenceonchain.com](https://spectra.intelligenceonchain.com). There is no install and no API key to configure — every data source is handled server-side.
There are two routes in.
{% tabs %}
{% tab title="Subscription" %}
Three tiers, each a monthly credit balance plus a set of unlocked modules.
| Tier | Credits / month | Modules |
| -------------- | --------------- | -------- |
| **Basic** | 30 | 8 of 12 |
| **Pro** | 75 | 10 of 12 |
| **Enterprise** | 400 | 12 of 12 |
Credits reset to the full balance on your renewal date rather than rolling over. Upgrading, downgrading or resubscribing also triggers a refresh.
**You can upgrade your subscription, using the 'Subscription' button at the top right of the screen**
Spectra showing the amount of API calls remaining alongside the subscription level
Using Stripe to change your subscription
{% endtab %}
{% tab title="IOC token" %}
Holding 100 IOC token unlocks Spectra without a monthly subscription.
Sign in with the wallet holding your balance and access is verified on-chain. You do not transfer or lock the tokens — the check is a read of your balance at sign-in.
Check the current threshold before buying, as it is set by Intelligence On Chain and can change.
{% endtab %}
{% endtabs %}
#### What each tier unlocks
| Module | Basic | Pro | Enterprise |
| ---------------------------- | :---: | :-: | :--------: |
| Domain Search | ✅ | ✅ | ✅ |
| Wallet Mentions | ✅ | ✅ | ✅ |
| Username Deep Search | ✅ | ✅ | ✅ |
| Obsidian Case Manager | ✅ | ✅ | ✅ |
| Dork Trace | ✅ | ✅ | ✅ |
| Domain Quick OSINT | ✅ | ✅ | ✅ |
| Email Extractor | ✅ | ✅ | ✅ |
| Exchange X-ray | ✅ | ✅ | ✅ |
| Temporal Analysis | — | ✅ | ✅ |
| Multi-Wallet Researcher | — | ✅ | ✅ |
| Tornado Withdrawal Viewer | — | — | ✅ |
| Tornado Cluster Investigator | — | — | ✅ |
###
***
### How credits work
One credit is the unit of work. Every module run costs a fixed number, deducted when the run completes.
| Module | Cost | Deep mode |
| ---------------------------- | :--: | :-------: |
| Domain Search | 1 | — |
| Wallet Mentions | 2 | 5 |
| Username Deep Search | 2 | — |
| Obsidian Case Manager | 2 | — |
| Dork Trace | 2 | — |
| Domain Quick OSINT | 3 | — |
| Email Extractor | 3 | — |
| Temporal Analysis | 3 | — |
| Exchange X-ray | 5 | — |
| Multi-Wallet Researcher | 5 | 10 |
| Tornado Withdrawal Viewer | 20 | — |
| Tornado Cluster Investigator | 25 | — |
{% hint style="warning" %}
**Verify these against the app before quoting them.** The costs above are documented from the module registry and can change as modules are revised. The balance shown in the app is authoritative.
{% endhint %}
#### Spending sensibly
A few habits stretch a balance a long way.
**Triage cheap, then commit.** Domain Search costs 1 credit and Wallet Mentions costs 2. Run those first across a list of candidates, and spend the 20–25 credit modules only on the two or three that survive.
**Batch the researcher.** Multi-Wallet Researcher charges per wallet, so a five-wallet batch costs the same as five single runs — but takes one pass and produces one comparable report.
**Deep mode is a decision, not a default.** Deep search on Wallet Mentions costs 5 rather than 2. Use it when the standard run returned something worth expanding, not as the opening move.
**A failed run does not charge you.** Charging happens per completed unit of work, so a batch that fails partway bills only for what finished.
***
### Your first investigation
Take an address you already know something about — a wallet from a case you closed, an exchange hot wallet, or a public entity. Knowing the answer in advance is the fastest way to calibrate what the output means.
{% stepper %}
{% step %}
#### Paste the identifier
Spectra accepts EVM addresses, transaction hashes, Bitcoin and Solana addresses, ENS names, domains and usernames. It identifies the type as you type.
{% endstep %}
{% step %}
#### Run Wallet Mentions (2 credits)
The cheapest useful first look. It searches the address across Google, Brave, Arkham and six social platforms simultaneously, and tells you whether it has ever been posted publicly.
If it returns nothing, that is information: an address with no web footprint is unlikely to be an exchange, a service, or a known scammer.
{% endstep %}
{% step %}
#### Follow what you found
The result determines the next move rather than a fixed sequence.
* **Named entity or exchange** → the trail may end here; consider whether a subpoena is the next step rather than more analysis.
* **A username or handle** → Username Deep Search.
* **A domain** → Domain Quick OSINT.
* **Nothing at all** → Exchange X-ray if funds moved through a swap service, or Temporal Analysis to profile the operator.
{% endstep %}
{% step %}
#### Export before you close the tab
Every module offers a Markdown or CSV export carrying timestamps and the source of each fact. Do this even for a dead end — a documented dead end saves someone repeating it.
{% endstep %}
{% endstepper %}
***
### The modules
Wallet Mentions — 2 credits · Basic
**Question it answers:** has this address ever appeared publicly anywhere?
Searches an address across Google and Brave in parallel, looks it up in Arkham Intelligence, and sweeps six social platforms — X, LinkedIn, Reddit, YouTube, Instagram and Facebook — plus paste sites and code repositories.
**Input:** any blockchain address.
**Returns:** search results grouped by source, an Arkham entity card where the chain is supported, and social mentions per platform.
**Deep mode (5 credits)** adds cross-chain presence and counterparty data.
**Use it when** you are starting cold and want the cheapest possible read on whether the address is known.
**Limitations:** absence of mentions is weak evidence of anything. Search engines index a fraction of the web, and an address can be widely used and never posted.
Exchange X-ray — 5 credits · Basic
**Question it answers:** where did funds go after entering an instant exchange?
Instant exchanges break the on-chain trail by design: funds go into a hot wallet and unrelated funds come out the other side. Exchange X-ray reconstructs the likely pairing by matching the two legs on **timestamp proximity** and **USD value**, with tolerances you control.
**Supports:** ChangeNow, FixedFloat, eXch, SideShift, SimpleSwap and four others.
**Input:** the deposit transaction or the hot wallet address, plus a time window.
**Returns:** candidate output transactions ranked by match quality, with an Arkham link on each. Higher-value outputs are flagged automatically, since these are a common laundering signature.
**Tuning:** start with a tight time tolerance and widen it. A wide window on a busy service returns everything and tells you nothing.
**Limitations:** this is correlation, not proof of a link. On a quiet service with an unusual amount the match can be near-certain; on a busy service with a round number it can be worthless. The tolerance settings exist so you can see which situation you are in.
Temporal Analysis — 3 credits · Pro
**Question it answers:** when does whoever controls this wallet actually work?
Transaction timing is behavioural evidence. Humans sleep, work weekdays, and operate in one timezone. Automated systems do not.
**Input:** a wallet address or contract.
**Returns:** hour-of-day and day-of-week activity distributions, the gap distribution between consecutive transactions, an activity-over-time chart, and an inferred operating window.
**Use it when** you have no identity leads and need to characterise the operator, or when you want to test whether two wallets behave like the same person.
**Limitations:** a wallet with few transactions produces a meaningless distribution. Bots, contracts and shared custody all break the human-behaviour assumption. Timezone inference gives a range, not a country.
Multi-Wallet Researcher — 5 credits per wallet · Pro
**Question it answers:** which of these forty addresses deserve my attention?
Paste a list of wallets and receive a comparable assessment of each: holdings, transaction history, web footprint and a risk score.
**The risk score reports its own confidence.** A wallet with four of nine signals present is rated differently from one with all nine, even where the score is identical. A brand-new wallet with no history is reported as **low risk, low confidence** — not medium risk because nothing was found.
**Every fact carries a source badge**, so you can see which came from an explorer, which from search, and which were derived.
**Deep mode (10 credits per wallet)** adds cross-chain presence, counterparty analysis and token transfer history.
**Limitations:** it is a triage tool. It ranks a list; it does not close a case.
Tornado Withdrawal Viewer — 20 credits · Enterprise
{% hint style="info" %}
Technical Breakdowns can be found here: [Tornado.Cash Withdrawal Viewer](/technical-module-guidance/tornado-cash-withdrawal-viewer.md)
{% endhint %}
**Question it answers:** who withdrew from this pool, and when?
Enumerates every withdrawal across all Tornado Cash ETH pool denominations, batched by contract and then listed line by line with dates, times and amounts, aggregated per recipient address.
**Returns:** per recipient — withdrawal count, cumulative ETH, and the date range the withdrawals span. Exportable as CSV.
**Use it when** you have established that funds entered a pool and you need the population of addresses that came out. This is the input to cluster analysis.
**Limitations:** enumeration is not attribution. This tells you who withdrew; it does not tell you which withdrawal corresponds to which deposit. Nothing can.
#### Cluster Analyser
Once you have retreived the withdrawal addresses, you can then run some cluster analysis.
{% hint style="info" %}
Technical Breakdowns can be found here: [Tornado.Cash Withdrawal Viewer](/technical-module-guidance/tornado-cash-withdrawal-viewer.md)
{% endhint %}
Tornado Cluster Investigator — 25 credits · Enterprise
{% hint style="info" %}
Technical Breakdowns can be found here: [Tornado.Cash Investigator](/technical-module-guidance/tornado.cash-investigator.md)
{% endhint %}
**Question it answers:** which of these withdrawal addresses are probably the same person?
A Screenshot showing the Tornado.Cash Depositor Address to then find matching outputs
The most involved module in Spectra. Given a set of recipient addresses, it maps the relationships between them and groups them into confidence-scored clusters.
**Link types detected, scored separately:**
| Link | Meaning | Weight |
| ------------------- | ---------------------------------------------------------- | --------- |
| Direct transfer | One recipient sent funds to another | Strongest |
| Shared intermediary | Two recipients both transacted with the same third address | Moderate |
| Two-hop | Connected through two intermediate addresses | Weakest |
**Also surfaces:** co-timed withdrawal windows, viewed by day and by hour, so recipients withdrawing inside the same narrow period are visible as a group.
**Noise handling:** exchange hot wallets connect to everything and would merge every cluster into one; dust-poisoning manufactures links that were never real. Both are filtered out, and **every exclusion is written to diagnostics** so you can review what was dropped and disagree.
**Output:** clusters with a confidence rating, full addresses with no truncation, and bulk copy per cluster or time window.
{% hint style="danger" %}
**A cluster is a lead, not a finding.** The module produces a shortlist of addresses that plausibly share an operator. Verification is a separate job. See [Methodology](#methodology).
{% endhint %}
Domain Quick OSINT — 3 credits · Basic
**Question it answers:** what is behind this domain, and what else is behind it?
Fires fifteen data sources at a single domain in one pass: WHOIS and RDAP registration, passive DNS, certificate transparency via crt.sh, open port discovery, HTTP header and tech-stack fingerprinting, AlienVault OTX threat pulses, Shodan InternetDB, and the full Wayback CDX historical URL inventory.
**The high-value output is usually the certificate.** A phishing domain frequently shares a TLS certificate with every other domain in the same campaign, which turns one lead into the whole set.
**Requires no API keys.** All fifteen sources are handled for you.
**Limitations:** privacy-protected WHOIS is now the default at most registrars, so ownership data is often withheld. The certificate and DNS history are usually more productive.
Domain Search — 1 credit · Basic
**Question it answers:** is this domain worth three credits?
A fast, cheap first look at registration and hosting. Built for triaging a long list before committing to full sweeps.
Username Deep Search — 2 credits · Basic
**Question it answers:** where else does this person exist online?
Maps a username or real name across the web: profiles, forum activity, breach appearances and indexed public data.
**Covers:** Google-backed broad web search with caching, HIBP and Dehashed breach pivots, and seven social platforms — X, Bluesky, Facebook, LinkedIn, Instagram, YouTube and Tumblr. Supports inText and filetype dork modes.
**Use it when** an on-chain trail has produced a handle, an email fragment or a name.
**Limitations:** common usernames produce false positives at scale. Corroborate across at least two independent sources before treating a match as the same person.
Dork Trace — 2 credits · Basic
**Question it answers:** what does the whole search-engine surface say about this string?
Runs an exact-match query across Google and Brave together, with one-click expansion to DuckDuckGo, Bing, Yandex and Mojeek. Includes file-type dorks (PDF, DOC, XLS, CSV) and a paste-site leak sweep across fifteen or more sites.
**Why multiple engines:** they index differently. Yandex and Mojeek routinely surface pages Google has dropped, which matters for material that has been taken down.
Email Extractor — 3 credits · Basic
**Question it answers:** who works at this organisation, and how do I reach them?
Returns publicly listed email addresses for a domain, with first name, last name and job title where available. Exports as a Markdown table.
**Use it for** attribution work and for identifying which addresses a phishing campaign is likely to target.
Obsidian Case Manager — 2 credits · Basic
**Question it answers:** where does all of this actually live?
Downloads and manages a curated Obsidian plugin set configured for investigation casework — linked notes, a file structure that survives a long case, and no third-party service holding your material.
Routed through a CORS proxy, so plugin downloads are not rate-limited.
**Why Obsidian:** the vault is plain Markdown files on your own disk. Nothing to migrate, nothing to lose access to, and the exports from every other Spectra module drop straight in.
***
### Tornado Cash analysis
This is the part of Spectra most likely to be misunderstood, so it is worth being precise.
#### What cannot be done
Tornado Cash severs the on-chain link between a deposit and a withdrawal. That is the entire function of the protocol and it works. **No tool recovers that specific link**, Spectra included. Anyone claiming to reverse the cryptography is either mistaken or selling something.
#### What can be done
The pool is opaque. Everything around it is not.
**Recipients that transact with each other.** A wallet that withdraws from a mixer and then sends funds directly to another withdrawal address has undone much of the benefit. This is the strongest available signal.
**Shared intermediaries.** Two recipients that both interact with the same third address are linked, more weakly, but meaningfully once other signals agree.
**Withdrawal timing.** Withdrawals inside a narrow window suggest one operator working through a list. On a quiet pool this is a strong signal; on a busy pool it is close to noise, which is why Spectra shows the surrounding traffic rather than the window alone.
**Funding ancestry.** Where the gas came from, and whether several recipients were funded from a common source.
#### What that adds up to
A shortlist. Forty withdrawal addresses become perhaps three worth investigating, each with a confidence figure and the reasoning that produced it.
{% hint style="warning" %}
**On the word "demixing."** It is the term people search for, so it is worth saying plainly what it can mean in practice: narrowing a candidate set on probabilistic evidence. It does not mean reversing the mixer, and a cluster is never proof of common ownership on its own.
{% endhint %}
#### Suggested sequence
1. **Tornado Withdrawal Viewer** (20cr) — enumerate the recipient population for the relevant pool and period.
2. **Tornado Cluster Investigator** (25cr) — map relationships across that population.
3. **Temporal Analysis** (3cr) — profile the two or three strongest candidates individually.
4. **Wallet Mentions** (2cr) and **Username Deep Search** (2cr) — attempt attribution on the survivors.
Roughly 55 credits for a full pass. Within an Enterprise balance this is comfortable; on Pro the first two steps are unavailable.
***
### Workflows
{% tabs %}
{% tab title="Stolen funds" %}
#### Tracing a theft to an off-ramp
**Starting point:** the victim's wallet and the outbound transaction.
1. **Follow the hops manually** in an explorer until funds reach a service address. Spectra does not replace this step.
2. **Identify the service.** If it is an instant exchange, run **Exchange X-ray** (5cr) with a tight time window.
3. **Match the output leg** on timestamp and value. Widen tolerance gradually. Note any higher-value outputs the module flags.
4. **Continue from the output address** — repeat until funds reach a KYC venue or a mixer.
5. **At a KYC venue**, analysis stops and process begins: the deposit address plus your documented trail is what an exchange compliance team needs.
6. **At a mixer**, switch to the [Tornado workflow](#tornado-cash-analysis).
**Typical cost:** 10–20 credits across two or three swap services.
{% endtab %}
{% tab title="Attribution" %}
#### Putting a name to an address
**Starting point:** an address with no obvious owner.
1. **Wallet Mentions** (2cr) — has it been posted publicly anywhere?
2. If a **handle** appears → **Username Deep Search** (2cr) across seven platforms and the breach corpora.
3. If a **domain** appears → **Domain Quick OSINT** (3cr). Check the certificate for sibling domains.
4. If a **name** appears → **Email Extractor** (3cr) against the associated domain.
5. **Temporal Analysis** (3cr) to corroborate — does the operating window match the timezone the identity implies?
**Corroboration rule:** two independent sources before you treat an identity as established. A username match alone is not attribution.
**Typical cost:** 7–13 credits.
{% endtab %}
{% tab title="Campaign mapping" %}
#### One phishing domain to the whole operation
**Starting point:** a single drainer or phishing domain.
1. **Domain Quick OSINT** (3cr). The TLS certificate is the highest-value field — campaigns routinely share one across every domain.
2. **Dork Trace** (2cr) on the distinctive strings: wallet addresses in the page source, contact handles, unusual copy.
3. **Domain Search** (1cr each) to triage the sibling domains cheaply.
4. **Wallet Mentions** (2cr) on the drainer wallet found in the page source.
5. **Multi-Wallet Researcher** (5cr per wallet) if the campaign uses a set of collection addresses.
**Typical cost:** 15–30 credits depending on campaign size.
{% endtab %}
{% endtabs %}
***
### Reading the output
#### Risk and confidence are two different numbers
This is the single most important thing to understand about Spectra's output.
**Risk** is how concerning the wallet appears. **Confidence** is how much evidence that assessment rests on.
| Reading | Means |
| -------------------------- | -------------------------------------------------------------- |
| High risk, high confidence | Multiple signals agree. Act on it. |
| High risk, low confidence | One strong signal, nothing corroborating. Investigate further. |
| Low risk, low confidence | Little was found. **Not** the same as "clean." |
| Low risk, high confidence | Substantial history, nothing concerning in it. |
A fresh wallet with three transactions returns **low risk, low confidence**, because there is nothing to assess. Tools that return "medium risk" in this situation are converting absence of evidence into evidence of absence, and that is how people get wrongly flagged.
#### Source badges
Every fact carries its origin — `ETHERSCAN`, `ARKHAM`, `BRAVE`, `HIBP`, `CRT.SH`, `DERIVED`. `DERIVED` means Spectra calculated it rather than read it, and it is the label to scrutinise when a finding matters.
#### Confidence bands on links
| Band | Reading |
| --------- | ----------------------------------------------------- |
| 80–100% | Strong. Direct on-chain relationships. |
| 60–79% | Moderate. Usually shared intermediaries. Corroborate. |
| Below 60% | Weak. Displayed faded. A lead, nothing more. |
***
### Methodology
Spectra is built on a position worth stating explicitly, because it shapes every output.
**Conclusions drawn across chain data and open sources are judgements about likelihood, not facts retrieved from a database.** On-chain data is complete but anonymous. Open-source data is rich but unreliable. Anything derived from combining them is probabilistic.
Four principles follow.
**Confidence is scored, not implied.** A 44% link is presented as a 44% link rather than rounded into the narrative.
**Competing explanations stay visible.** Alternatives are recorded alongside the leading hypothesis, with the evidence that would shift weight between them. This is Analysis of Competing Hypotheses, and it exists because the failure mode in investigation is not missing evidence — it is settling on an explanation early and reading everything afterwards as support for it.
**Absence of evidence is reported as absence.** Nothing found means low confidence, not medium risk.
**Leads are labelled as leads.** Clustering and timing correlation produce candidates for verification, and the interface says so in the same place it shows the result.
{% hint style="info" %}
**Practical habit:** before acting on a cluster, write down what would have to be true for it to be wrong. If you cannot answer, you have not tested it — you have accepted it.
{% endhint %}
***
### Exporting and case management
Every module exports **Markdown** or **CSV**. Exports carry a timestamp, the source of each fact, and the confidence rating where one applies.
**Markdown** for narrative work — reports, handovers, anything a person will read. Drops straight into an Obsidian vault.
**CSV** for data work — address lists, withdrawal enumerations, anything you will sort or cross-reference in a spreadsheet.
#### A workable case structure
```
CASE-2291/
├── 00-summary.md the current picture, rewritten as it changes
├── 01-timeline.md what happened, in order, with timestamps
├── 02-addresses.csv every address, with role and confidence
├── exports/ raw Spectra exports, unedited
│ ├── 2026-08-04-wallet-mentions.md
│ ├── 2026-08-04-exchange-xray.md
│ └── 2026-08-05-cluster.csv
└── 99-deadends.md what you ruled out, and why
```
Two habits that repay themselves:
**Never edit a raw export.** Keep it as retrieved and write your analysis in a separate file. When someone asks where a figure came from six weeks later, you want the original.
**Keep the dead ends.** The single most wasteful thing in a long investigation is repeating a line of enquiry that was already exhausted — usually by yourself.
***
### Troubleshooting
A module returned nothing
Usually genuine. An address with no web presence, a domain with privacy-protected registration, or a username that does not exist all return empty results legitimately.
Check the input type was identified correctly — a truncated address or a transaction hash pasted where an address was expected will return nothing rather than an error.
Exchange X-ray returned too many candidates
The time or value tolerance is too wide for the volume that service handles. Tighten the time window first — it discriminates far more than value on a busy exchange.
If tightening to a few minutes still returns dozens of candidates, the service is too busy at that amount for correlation to be meaningful. That is a finding: record it and pursue another line.
Cluster analysis merged everything into one group
Almost always an unfiltered hub — an exchange or service address that connects to everything. Check the diagnostics panel, which lists every address the filter excluded. If a hub is missing from that list, exclude it manually and re-run.
Credits were deducted for a failed run
Charging is per completed unit of work, so a failed batch should bill only for the wallets that finished. If a balance looks wrong, note the timestamp and the module and raise it — the run log is the record.
Token access is not being recognised
Confirm you signed in with the wallet actually holding the balance, not a linked or hot wallet, and that the balance meets the current threshold. The check reads your balance at sign-in, so a transfer made after signing in will not register until you sign in again.
***
### Glossary
**Attribution** — connecting an address to a real-world identity. Distinct from tracing, which follows value without naming anyone.
**Cluster** — a set of addresses assessed as probably under common control. A conclusion about likelihood, not ownership.
**Co-timed withdrawal** — withdrawals from a mixer inside a narrow window, suggesting one operator working through a list.
**Demixing** — commonly used to mean recovering deposit-to-withdrawal links. In practice, narrowing a candidate set on probabilistic evidence. The cryptography is not reversed.
**Dust-poisoning** — sending tiny amounts to unrelated addresses to manufacture on-chain links, either to confuse analysis or to bait address-copying mistakes.
**Hub** — an address connected to a very large number of others, typically an exchange hot wallet. Merges unrelated clusters if not filtered.
**Instant exchange** — a swap service requiring no account, used to break the on-chain trail between two assets.
**Two-hop link** — a connection through two intermediate addresses. Present in the output because it can matter in combination, weighted low because on its own it rarely does.
***
### Where to go next
* [**Open Spectra**](https://spectra.intelligenceonchain.com) — the platform itself
* [**Training and certification**](https://intelligenceonchain.com/courses) — three-stage progression assessed on real casework
* [**Intelligence On Chain**](https://intelligenceonchain.com) — who builds it
{% hint style="info" %}
Found something in this guide that does not match the app? Tell us — the documentation should follow the tool, not the other way round.
{% endhint %}