Investigations & Attribution
Find out who is behind it. Then prove it.
When a threat has a face you cannot see, our investigators identify the people, organizations and infrastructure behind it, and document every step so the finding can be acted on by your board, your counsel or law enforcement.
- Typical duration
- 2 to 4 weeks
- Urgent tasking
- First assessment within 24 hours
- Team
- Lead investigator, 2 to 4 specialist analysts and an independent red-team reviewer
- Deliverable
- Finished report, hashed evidence bundle and investigator debrief
- Pricing
- Fixed fee agreed at scoping
When to call us
The questions that start an investigation.
Most of our investigations begin with a simple question that internal teams, platforms or previous vendors could not answer: who is doing this, and how do we stop them?
Fraud and scam networks
Investment schemes, impersonation sites, invoice fraud and romance scams, traced to the operators and the accounts that move the money.
Extortion and harassment
Anonymous accounts, threatening messages and coordinated targeting of staff, executives or their families.
Leaks and disclosures
Confidential documents or plans surfacing online, investigated under the direction of counsel and within employment law.
Counterfeit and brand abuse
The sellers, storefronts, factories and logistics behind counterfeit goods and impersonation of your brand.
Hostile campaigns
Smear campaigns, fake reviews and coordinated attacks on your reputation, mapped to the people and vendors running them.
Asset location
Property, companies, vessels, aircraft and digital assets controlled by a subject or a judgment debtor, in any jurisdiction with public records.
What you receive
A finished answer, not a data dump.
Every investigation ends in a finished intelligence report written for the person who has to make the decision, backed by an evidence bundle written for the person who has to check it.
- An executive summary that answers the question in the first paragraph
- Named subjects, each with a stated confidence level
- A step-by-step account of how every conclusion was reached
- An evidence bundle with every source captured, timestamped and hashed
- The alternative explanations we tested, and why they were rejected
- Recommended next steps: legal, platform, law enforcement or operational
How it runs
From first question to referral package in weeks, not months.
A typical investigation runs for two to four weeks. You receive interim updates at agreed points, and we tell you immediately if the evidence changes the question.
-
01 / Scope
Days 1 to 2
We agree the question, write the intelligence requirements, confirm the legal basis and screen the request against our ethics policy.
-
02 / Collect
Days 2 to 8
Analysts collect across open, deep and dark web sources through managed attribution. Every item is captured, timestamped and hashed.
-
03 / Attribute
Days 6 to 14
Entities are resolved, pivots are exhausted and competing hypotheses are tested until only the explanation the evidence supports remains.
-
04 / Deliver
Days 12 to 18
An analyst who did not work the case challenges every attribution. Then you receive the report, the evidence bundle and a debrief.
Tradecraft
How anonymity actually fails.
People who hide online rarely make one big mistake. They make many small ones: a reused username, a recycled image, a payment account shared across projects. Our investigators are trained to find and connect them.
- Infrastructure pivotingRegistration history, certificate transparency records, hosting overlaps and shared analytics or advertising identifiers that tie websites to one operator.
- Identity resolutionUsername and email patterns, avatar reuse, writing style and behavioral overlaps that connect personas to each other and to real people.
- Image and video forensicsGeolocation, chronolocation from shadows and weather, reverse image search, metadata review and checks for manipulation or synthetic generation.
- Registry and court researchCompany filings, officer histories, court dockets, property and procurement records in more than 140 jurisdictions.
- Blockchain tracingAddress clustering, flow-of-funds analysis and identification of cash-out points on public ledgers, packaged for legal follow-up.
- Closed communitiesForums, markets and channels researched through vetted, non-attributable personas that observe and never engage subjects.
- Native-language analysisAnalysts working in 41 languages, including the slang, transliterations and coded terms that machine translation misses.
- Timeline reconstructionArchived pages, deleted posts and activity patterns rebuilt into a chronology that holds up under cross-examination.
Results
Investigations that ended in action.
Client names are withheld and identifying details changed. The methods, timelines and outcomes are reported as they happened.
Retail banking
212 domains, one operator
A shared tracking tag tied a sprawling investment scam to a single operator, his payment rails and the shell companies holding the proceeds.
Technology manufacturing
Attributing a product roadmap leak in nine days
A confidential roadmap surfaced on an enthusiast forum. Screenshot artifacts, posting habits and the client's own access records narrowed 340 possible sources to one.
Questions
Investigations FAQ
Can you identify someone who is deliberately anonymous?
Often, but not always. Anonymity usually fails through reuse of usernames, images, infrastructure, writing habits or payment methods. Within the first 48 hours we tell you how likely attribution is based on what we have seen, and we never report a name the evidence does not support.
Is your work usable as evidence?
Admissibility is for the court to decide, but our collection is built for it. Every item is captured with a timestamp and a SHA-256 hash, our methods are documented and reproducible, and our investigators can provide witness statements and give evidence.
Do you contact the subject or use fake identities to get information?
No. We never contact subjects and never deceive anyone into providing information. We use non-attributable research infrastructure so that a subject cannot detect our research, which protects the investigation without misleading anyone.
What if the answer is not the one we expected?
You receive it anyway. Our findings are independent and our reports state what the evidence supports, including when it points away from the expected conclusion or clears the person you suspected.
Can you work under legal privilege?
Yes. Many investigations are commissioned through outside counsel so that our work product is protected. We follow your legal team's instructions on structure, reporting lines and communications.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.