From Open Web to Real-World Target: The OSINT Trail Behind Proxy Violence
- Nico Dekens | dutch_osintguy
- 5 minutes ago
- 13 min read
Why attacks on Jewish locations should be read not only as hate crimes or extremism cases, but sometimes as the visible endpoint of online grooming, proxy recruitment, and deniable state tradecraft.
We keep making the same mistake. We look at the person who got arrested near the synagogue, the school, the airport, the secure building, or the victim’s home, and we act as if that person is the whole story. Usually, they are not. Usually, they are just the part of the story we can still see.
The teenager.
The burnout.
The petty criminal.
The angry young guy with a burner phone and nothing going for him.
The local idiot looking for meaning.
The person with just enough grievance, ego, boredom, debt, or loneliness to become useful to somebody else.
That is the part most people focus on because it is visible. It is easy to understand. It fits inside a headline. It gives law enforcement a face, a suspect, a charge, a press release.
But the real story usually starts much earlier.
It starts online.
It starts in public and semi-public spaces where narratives are seeded, resentment is sharpened, enemies are simplified, and vulnerable people are quietly pulled closer. Closer to grievance. Closer to secrecy. Closer to action. Closer to becoming useful.
And that is exactly why this matters from an OSINT perspective.
Because if you only start paying attention once somebody throws the petrol bomb, scouts the building, carries the sniffer, lights the match, or pulls the trigger, you are already late.
Recent cases across Europe make that painfully clear. Dutch prosecutors said the arson attack on a Rotterdam synagogue had terrorist intent and was meant to instill fear in the Jewish community (Reuters). Authorities also investigated an explosion at a Jewish school in Amsterdam. In London, four ambulances belonging to a Jewish volunteer emergency service were set on fire in what police treated as an antisemitic hate crime. And in the Netherlands, after the shooting of a Dutch police staff member of Iranian descent in Schoonhoven, authorities said they had not ruled out a link to Iran and tightened security around Iranian dissidents.
People love to separate these things into neat boxes.
Hate crime.
Terrorism.
Espionage.
Sabotage.
Youth radicalisation.
Criminal violence.
Lone actor.
Nice boxes. Clean labels. Bad analysis.
Because from an OSINT perspective, those boxes can blind you. They make you stare at the final act and ignore the runway. They make you focus on the suspect instead of the system that made the suspect usable in the first place.
Not every attack on a Jewish target is state-backed. Not every anti-regime shooting is a proxy operation. Not every teenager in a Telegram channel is being groomed into violence. That is not the point. The point is that we are now seeing enough cases, enough warnings, and enough overlap between online grooming, criminal tasking, proxy violence, and deniable state tradecraft that it is no longer serious to ignore the possibility. Reuters has reported that Iran has increasingly relied on criminals and proxies in alleged plots against Jewish, Israeli, and dissident targets in the West, while Russia has been tied by Western officials to a growing sabotage campaign in Europe that also leans on recruited intermediaries and criminals.
That should change the questions we ask.
The question is not only: who did it?
The better questions are:
Who found them first?
Who gave them attention?
Who made them feel seen?
Who pulled them out of the crowd?
Who moved them off the open web?
Who tested them with smaller tasks?
Who picked the target?
Who benefits when they get caught?
That is where the real story starts.
Stop calling it random
One of the worst habits in this field is confusing chaos with spontaneity.
A teenager planning an attack looks chaotic.
A local criminal taking money to scout a target looks messy.
A young person walking around sensitive buildings with a Wi-Fi sniffer looks amateur.
A shooter on a scooter or in a stolen car looks like street-level violence.
People see that and think: sloppy, random, isolated. Maybe. Sometimes.
But sloppy does not mean unconnected.
Young does not mean self-directed.
Amateur does not mean harmless.
And random-looking does not mean random.
Look at the Dutch espionage case involving two teenagers who were allegedly approached through Telegram by a pro-Russian hacker. One of them was suspected of carrying out Wi-Fi collection near sensitive buildings in The Hague, including Europol and Eurojust. That should wake people up. You do not always need a trained intelligence officer under diplomatic cover anymore. Sometimes all you need is a recruitable teenager, a direct message, a simple technical task, and enough distance to deny everything later.
The Schoonhoven shooting matters for the same reason.
The facts are still developing, which is exactly why it is useful as a case study. Reuters reported that the victim was a 36-year-old Dutch police employee of Iranian descent who had publicly criticized Tehran. Dutch authorities said they were considering all scenarios and had not ruled out a link to Iran. NOS later reported that he had also been active online, including on Telegram channels he managed himself, where he asked people to share information about Iranian military targets and alleged regime collaborators. NOS also made clear that investigators have not established whether that online activity was connected to the shooting.
That uncertainty matters. Because this is exactly where analysts need discipline. Not fantasy. Not certainty. Discipline.
You do not need to claim that the shooter was definitely groomed through the same pipeline. You do not need to claim the attack was definitely state-directed. But you would be foolish not to see the possibility. A visible anti-regime figure. Public online activity. Telegram exposure. Political motive on the table. A possible hostile-state interest. A shooting in the Netherlands.
That combination should make any decent OSINT analyst sit up straight.
Because even if the person who pulled the trigger turns out to be local, low-level, or criminally connected, that still does not tell you who made him useful.
Grooming is not just a sexual abuse concept
People hear the word grooming and their brain goes straight to one thing: child sexual exploitation.
That is too narrow, way too narrow.
In this context, grooming is the process of identifying someone vulnerable, reachable, angry, lonely, reckless, greedy, ideologically curious, or socially adrift, and then gradually making that person more useful to you.
You give them:
Attention.
Language.
A role.
A grievance.
A place to belong.
A mission.
Then you slowly make secrecy normal and make action feel reasonable.
That is grooming too.
Sometimes it is:
Ideological.
Emotional.
Financial.
Social.
Sometimes it is nothing more than status and ego.
A lot of the people who end up doing the visible act are not disciplined ideologues. They are not master spies. They are not trained operators. They are often just unstable mixtures of resentment, boredom, alienation, bravado, and opportunity.
Which is exactly why they are useful.
That is where Russia and Iran fit into this story.
Russia’s recent sabotage model in Europe has repeatedly been described by officials and media reporting as one that leans on vulnerable people, criminal facilitators, and deniable intermediaries. Iran’s model has increasingly been described in similar terms, especially in plots linked to Jewish, Israeli, and dissident targets. Britain has accused a Swedish criminal network of carrying out attacks on behalf of Tehran. Australia said the men accused in a synagogue arson case may not even have known Iran was behind the operation. That detail matters a lot. A proxy does not need to know the full chain. A proxy does not need ideological clarity. A proxy just needs to be movable.
This is not James Bond. This is cheaper than that. Dirtier than that. More scalable than that.
This is outsourced coercion.
It is statecraft mixed with criminality.
Propaganda mixed with tasking.
Online influence mixed with real-world violence.
And when you see it that way, a lot of “random” incidents stop looking so random.
Why Jewish locations are such effective targets
Jewish targets are not chosen only because of hate.
They are also chosen because they work.
A synagogue is not just a building.
A Jewish school is not just a school.
A Jewish ambulance service is not just a set of vehicles.
These are symbolic targets. Identity targets. Fear targets.
Hit one and the damage is never only physical. The message travels far beyond the site. The effect spreads through a community fast. It creates fear, anger, insecurity, division, and headlines. For anyone trying to intimidate, polarize, provoke, or signal, that is efficient.
That is why these attacks matter even when the damage seems limited.
The Rotterdam synagogue case mattered because prosecutors said it was meant to instill fear in the Jewish community. The Amsterdam Jewish school explosion mattered for the same reason. The ambulances burned in Golders Green mattered because they were not random vehicles; they belonged to a Jewish volunteer emergency service. France placing two brothers under investigation for planning a “deadly and antisemitic” attack matters because it shows that this is not one city, not one country, not one isolated mood. It is a wider pattern of target selection built around symbolism and effect.
Not every one of these cases will lead back to the same network or sponsor. That is not what I am saying.
What I am saying is simpler.
Jewish targets are useful to people who want to send a message.
Useful to:
Extremists.
Copycats.
Criminal proxies.
Hostile states that want fear without fingerprints.
That should shape how we monitor them.
The pipeline: from open web to closed channel to physical action
This is the part a lot of people still do not understand.
By the time somebody is fully inside a private chat, a closed Telegram group, an encrypted Signal thread, or some small invite-only Discord server, you are already behind.
Not blind. Behind.
The most important work happens before that.
When the trail is still visible.
When the path is still open enough to map.
This is usually how it works.
Phase 1: Identification
The person does not need to be a committed extremist.
They just need to be reachable.
Maybe they:
Are isolated.
Are angry.
Are broke.
Are obsessed with conflict.
Want status.
Want belonging.
Just want to matter.
Are already circling violent, conspiratorial, or grievance-heavy spaces online.
This is where a lot of investigators fail. They look only for polished ideology. But usable people are often not polished anything. They are just open to being shaped.
Phase 2: Resonance
The narrative hit. Not necessarily a manifesto. Usually not even close.
More often it is a stream of content that makes the person feel understood. Humiliation. Revenge. Betrayal. Purity. Corruption. Anti-Jewish narratives. Anti-Western narratives. Anti-regime narratives. Heroic action. Secret truth. The idea that the world is rotten and that normal people are cowards.
This is not persuasion in one post.
It is conditioning over time.
Memes.
Clips.
Reposts.
Irony.
Comments.
Montages.
“News” accounts.
Influencer-adjacent garbage.
Pseudo-analysis.
Insider language.
The point is to create emotional alignment before operational movement.
Phase 3: Migration
This is the key moment. The subject is moved off the open web and into smaller, more controlled spaces.
Telegram.
Discord.
Signal.
WhatsApp.
Snapchat.
Burner accounts.
Temporary invite links.
Private group chats.
That move is usually framed as trust. Access. Seriousness. Truth.
“Main got banned.”
“Join the backup.”
“DM for the real channel.”
“Serious people only.”
“Can’t post the rest here.”
This is where audience starts becoming participant.
From an OSINT point of view, this moment matters more than a lot of explicit rhetoric. Because migration is not just a platform change. It is a selection event.
Phase 4: Testing
Now the person gets small tasks. Not the big one. Not yet.
Small things.
Harmless-sounding things.
Plausibly deniable things.
Can you repost this?
Can you check if this place is open?
Can you take a photo of the entrance?
Can you count cameras?
Can you see if security is there?
Can you make a burner account?
Can you carry a device?
Can you meet someone?
Can you do a simple favor?
Can you prove you are serious?
This is where the line gets crossed without the recruit fully realizing it.
Phase 5: Escalation
Now secrecy is normal. The person is deeper in, their world narrows.
Their emotional investment goes up.
The asks get more specific.
Targets become real places.
Times become specific.
Tasks become local.
Risk becomes part of the identity.
This is where somebody stops performing outrage and starts behaving operationally.
Phase 6: Physical action
Now it reaches the real world.
Reconnaissance.
Surveillance.
Intimidation.
Arson.
Bomb prep.
Courier work.
Device placement.
Wi-Fi collection.
Filming targets.
Access testing.
Shooting.
Attack planning.
This is the part the public finally notices.
Phase 7: Disposal
Then, if the person gets caught, injured, or killed, the system moves on.
That is the brilliance of the model.
The most visible person is often the least important person.
The person closest to the scene is often the easiest to replace.
That is why I keep coming back to the same point: the suspect matters, but the pipeline matters more.
What OSINT investigators should actually look for
If your whole monitoring strategy is built around threat keywords, you are going to miss a lot.
Most of the runway does not look like “I am going to attack target X at time Y.”
It looks softer, messier, more social and emotional than that.
The better approach is to watch for function, not just content.
Narrative seeding
Watch the places where targets get normalized and enemies get simplified.
That includes meme ecosystems, repost accounts, “news” channels, grievance pages, ideological influencer accounts, anonymous amplification networks, and all the semi-ironic trash that slowly turns real people into acceptable targets.
Early-stage signal is often emotional, not operational.
If you are waiting for explicit instructions, you are waiting too long.
Bridge accounts
Bridge accounts are the movers. They pull people from one ecosystem into another. They circulate invite links. They mirror fringe content into more visible spaces. They make closed spaces feel exclusive. They frame migration as authenticity.
A lot of investigators spend all their time staring at the loudest extremist channel. Fine. But the bridge account is often the one doing the real work.
It is the digital equivalent of the person standing at the doorway, deciding who comes further inside.
Escalation language
Language shifts before behavior shifts. Watch for the move from opinion to identity to duty.
People like us.
Real men act.
Enough talk.
Prove yourself.
Anyone local?
Who can help?
Small job.
Easy money.
You get it.
You are not like the others.
None of this proves intent on its own. That is not the point.
The point is pattern.
Repetition.
Context.
Convergence.
Target rehearsal
A lot of pre-operational behavior still leaks out into the open.
Photos of entrances.
Videos of side streets.
Questions about opening times.
Posts about security.
Mentions of holidays.
Interest in guard routines.
Camera placement.
Escape routes.
Parking.
Loading areas.
Blind spots.
One photo means nothing.
Ten related traces around the same kind of target mean something.
Selective attention
This is one of the biggest grooming signals and one of the most overlooked.
Who is suddenly getting special attention?
Who is being praised?
Who is being pulled into side chats?
Who is being told they are useful, brave, serious, trustworthy, chosen?
That is often where passive engagement turns into personal recruitment.
A deeper collection strategy
If I were building a collection plan around this, I would not start by saying, “Let’s monitor Telegram.”
That is too shallow. I would build it in layers.
First, map the narrative layer.
Who is seeding grievance? Who is simplifying enemies? Who is framing certain targets as legitimate, symbolic, or overdue?
Second, map the migration layer.
Who is moving people? Which accounts keep pointing users somewhere else? Where do invite links appear? Which handles disappear and reappear? Which backup channels keep emerging?
Third, map the tasking layer.
Where do local asks show up? Who is asking for photos, route checks, security checks, target verification, local knowledge, or “small favors”?
Fourth, map the target layer.
Which Jewish locations, dissident figures, secure buildings, or symbolic institutions are being discussed, filmed, hinted at, or emotionally fixated on?
Fifth, map the role layer.
Not everyone in the ecosystem does the same job.
Some seed.
Some amplify.
Some validate.
Some bridge.
Some recruit.
Some task.
Some scout.
Some carry out the act.
That role-based view is much closer to reality than just dumping all accounts into one bucket called “extremists.”
The Schoonhoven lesson
The Schoonhoven case matters because it expands the lens.
This is not only about Jewish locations, although those remain highly exposed and symbolically attractive. It is also about dissidents, critics of authoritarian regimes, and public-facing opponents who create their own visibility online.
The victim in Schoonhoven was not hidden.
He was visible.
Publicly critical.
Active online.
Active on Telegram.
Operating in the Netherlands.
Tied to the police.
That creates an attack surface.
And again, discipline matters here. The investigation is still developing as I write this blog. Dutch authorities have not proven a direct Iranian connection. NOS explicitly noted that it is not known whether the victim’s online anti-regime activity was linked to the motive for the shooting.
But analytically, the case still matters.
Because it shows how online visibility can become operational visibility.
How a person can become targetable across borders.
How an authoritarian regime or its intermediaries do not necessarily need to send their own polished operative.
How the person who finally shows up with the gun may be the cheapest part of the whole chain.
Maybe the shooter was groomed in a similar way. Maybe not.
That remains unproven.
But the model fits closely enough that investigators should at least have the discipline to consider it.
Russia, Iran, and the disposable actor
The reason Russia and Iran keep coming up in this conversation is not because every case belongs to them.
It is because both have shown a willingness to use people they can burn.
That is the logic.
Use someone expendable to do something visible.
Keep the sponsor distant.
Create fear.
Create noise.
Complicate attribution.
Make the whole thing look messy enough that people argue over whether it was hate crime, sabotage, extremism, criminality, or covert action.
That ambiguity is not a bug. It is part of the value. And it works especially well when the person on the ground is young, isolated, reckless, broke, criminally available, or hungry for meaning.
That is why the throwaway operative matters so much now.
Not the master spy.
Not the movie villain.
Not the elite operative.
The disposable one.
The one who can be nudged, used, and replaced.
Closing
The future threat picture is not always going to show up in the form people expect. It will not always look like a trained intelligence officer. It will not always look like a formal terrorist cell. It will not always look like a hardened extremist network with a clear hierarchy and a manifesto.
Sometimes it will look like a teenager in a Telegram chat. Sometimes it will look like a petty criminal doing a “simple job.” Sometimes it will look like a local scout, a courier, a vandal, or a shooter who thinks he is only helping a cause, making easy money, or finally becoming important.
That is exactly why OSINT matters. Not because it can see everything inside closed spaces. It cannot. But because it can still see the runway before the fire starts.
It can see the bridge before the migration. It can see the narrative before the tasking. It can see target rehearsal before the violence.
The mistake is to focus only on the person closest to the flames. The teenager. The runner. The lookout. The shooter. They matter, but analytically they may be the least strategic person in the story.
The real question is who made them useful. And if we keep failing to ask that question early enough, we will keep mistaking the smoke for the fire.