Somebody is using your name.
We find out who.
When fraud is run in a company's name, the company is usually the last to know. The customer finds out first, then the support desk, then the brand. We work the other way round: we look for the infrastructure before the campaign reaches anyone.
What we watch for
-
Lookalike domains
Registrations that imitate yours: a swapped letter, an added hyphen, a different ending. Most fraud against a brand starts with a domain registered days before the campaign.
-
Fake apps and listings
Apps published under a name close to yours, and store listings using your logo, screenshots or copy.
-
Impersonation accounts
Profiles and channels posing as your company, your support desk or your founders, on the platforms your customers actually use.
-
Messages sent in your name
SMS and WhatsApp campaigns that spoof your sender ID or borrow your wording to reach your customers.
-
Credentials and data in the open
Company credentials, keys and customer data surfacing in breach dumps and paste sites.
-
Infrastructure behind the copy
Who registered it, what else they registered, and whether one operator is running several fronts at once.
How we work
The method is open-source intelligence, and it is the same one behind everything published on this site. Registration records, hosting and nameservers, certificate history, app publisher details, company registries, and where an image has appeared before. Public records, read carefully, in the order that tells you who is behind something.
The output is a written record you can act on: what exists, who appears to be running it, what connects one front to another, and the evidence for each claim. Where the finding supports a takedown or a police complaint, it is documented so somebody else can verify it.
What this is not
- Not a takedown service. We find and document. Filing with a registrar, a platform or the police is yours to do, and our output is written to support it.
- Not law enforcement. We have no power to compel anyone, seize anything or arrest anybody.
- Not a guarantee. An operator who leaves no public trace cannot be traced from public records. We say so when that is the answer, rather than filling the gap with inference.
What the work looks like
The Trifleck investigation is the public example. A fake recruiter approached an engineer in Bengaluru with a malicious file. Public records tied the recruiter's company to three other fronts: the live websites share one registrar and one Icelandic privacy proxy, two were registered three hours and ten minutes apart on the same day, two list the same street address, and the recruiter's photograph came from a fourteen-year-old profile. That is the shape of the output, published in full so you can judge it before you engage us.
Talk to us
Tell us the brand, what you have seen so far, and what you need it for: a takedown, a complaint, a board briefing, or simply knowing. We will tell you honestly whether public records are likely to answer it before any money is discussed.