In the battle to link real-world criminals to their anonymous bitcoin troves, Chainalysis has found a “meaningful” edge: a block explorer website that scrapes visitors’ internet protocol (IP) addresses.

According to leaked documents reviewed by CoinDesk, Chainalysis, the largest of the blockchain tracing firms, owns and operates walletexplorer.com. Like other block explorers, the service lets anyone view the history of public cryptocurrency wallet addresses. Chainalysis figures that bad actors would use its site to check transactions without fear of “leaving a ‘footprint’” on crypto exchanges, the documents said.

But where the exchanges – and presumably most block explorers – have no eyes, Chainalysis has set its sights. It “‘scrapes’ the IP addresses of suspicious” users that fall into the honeypot of walletexplorer.com according to the documents.

“Using this dataset we were able to provide law enforcement with meaningful leads related to the IP data associated with an address,” the documents, translated from Italian, say. “It is also possible to conduct a reverse lookup on any known IP address to identify other BTC addresses.”

In doing so, Chainalysis has effectively weaponized an unassuming website without disclosing its ties. It has never publicly associated itself with walletexplorer.com, although a note at the bottom of the site’s homepage says its “author” now works at Chainalysis. The website was created in 2014, according to site registration documents that make no mention of Chainalysis.

A spokesperson for Chainalysis declined to comment.

The documents, from a Chainalysis presentation to Italian police investigating the dark web, appeared late Monday on DarkLeaks, itself a dark web site only accessible through anonymizing browsers like Tor. CoinDesk has verified the documents’ authenticity.

The slide deck shines new light on the full range of tools that Chainalysis uses to assist law enforcement in nabbing illicit actors. The company is primarily known for parsing publicly available transaction data rather than using subterfuge.

The documents also show that Chainalysis thinks it can trace transactions in monero (XMR), which many consider to be the cryptocurrency with the strongest privacy defenses.

“Of the cases that Chainalysis worked on in collaboration with law enforcement, we were able to provide usable leads in approximately 65% of cases involving [m]onero,” the documents say.

This is a developing story. Refresh for updates.

UPDATE (Sept. 21, 18:25 UTC): Adds detail about walletexplorer.com in sixth paragraph.