Who is doing this, and what can they do?
Reduction shrinks what can be found and monitoring watches what cannot be removed. Groundtruth answers the findings that escalate: who is behind them, what they are capable of, and what a client or their counsel can act on.
Most risk reports stop at what a database can reveal: addresses, relatives, and personal details. But they leave the important questions unanswered. Who is behind the threat? What do they want? How far might they go?
Groundtruth goes further. Our investigators follow the evidence, work to establish who is responsible, and assess the risk you face.
Attribution under private investigator license · Confidence stated on every finding · Written for counsel
Investigations and attribution
Establishing who is behind an incident and what they are capable of, to a standard that holds when counsel files on it. The work a client needs once something has already surfaced.
Groundtruth Investigations
Our investigation and attribution service is available as a one-time project or through an ongoing retainer. Our licensed investigators follow the evidence, assess the reliability of their findings, and deliver clear reports that support informed decisions.
Two questions, two investigations.
Groundtruth answers a threat that has already surfaced. It runs in two directions: outward at the person creating the risk, and inward at the people through whom a client can be reached.
Threat actor attribution
Who is behind an account, a campaign, a letter, or a call. Identification where the evidence supports it, and a clear statement of what remains unresolved where it does not.
Capability and intent
Identification alone does not tell a client what to do. Every attribution is accompanied by an assessment of what the actor can actually reach, and whether the activity shows any indicator of moving from online to physical.
Circle of risk
When a client is hard to reach directly, the route runs through someone near them. This maps the household, the office, and the close associates, and assesses which of them is the shortest path in.
Circle of Trust covers the people around a client. Circle of Risk assesses them first, so the coverage is aimed rather than uniform.
How we investigate.
We follow the evidence, verify findings against multiple sources, and clearly distinguish facts from assumptions. Our conclusions never go further than the evidence supports.
Scope before collection
What is the actual question, what would answer it, and what would a court or a platform need to see. An investigation scoped to satisfy curiosity produces a report nobody can use.
Collection from lawful sources
Public records, open sources, commercial risk databases, breach and infostealer corpora, and the data broker ecosystem the firm indexes in CODEX. Nothing is obtained by access we do not have.
Pivot and corroborate
A single identifier is a lead, not a finding. The work is moving between selectors until two independent paths arrive at the same person, and noting honestly when only one does.
Assess capability, not just identity
A name answers half the question. The other half is proximity, resources, history, and whether anything in the pattern suggests escalation.
Report in a form that can be acted on
Findings, sources, and confidence, written so that counsel can file on it, a platform can act on it, or law enforcement can open on it. Delivered under private investigator license where attribution is in scope.
Two relevant case studies.
Client matters are not disclosed. These two investigations were published, so they can be shared with you. Both are the same method applied to a different question.
Tracing a doxxing site back to its source data
A site published names, home addresses, phone numbers, employers and vehicle details for roughly 1,700 people, then moved its operation to a dark web address. The public question was who was behind it. The more useful question was where the data came from, because that determined who else was exposed and what could be done about it.
Cross-referencing the published records against known breach corpora identified a single 2021 breach of a parking application as the source, with a 98.2 percent match on records where the subject drove the targeted make. The operators had enriched that breach with commercially available broker data. Among the targets we identified more than 150 people at materially elevated risk, including federal and military personnel and executives at major technology and financial firms.
Verifying the authorship of an anonymous message
In the hours after the New Year's Day Cybertruck incident, a message circulated claiming to come from a specific serving soldier and making a series of extraordinary claims. Newsrooms had to decide whether it was authentic before repeating any of it. The sender had used an anonymous mail provider.
Working only from the address itself, account registration signals were used to pivot to a phone number, the number to a named individual, and the identity back across several unrelated platforms until the same person was reached by more than one independent path. Repeat collection on later dates showed which of those signals were being removed, which is itself evidence. The account holder was confirmed. No conclusion was offered on the truth of the claims in the message, because that was a different question and the evidence did not reach it.
What we can and cannot promise.
Investigations cannot always provide definitive answers. We explain the limits up front and never claim more than the evidence supports.
It does not guarantee a name
Some actors are attributable and some are not. An investigation that returns unresolved, with the reasons and the dead ends stated, is a real outcome and it is reported as one. A firm that guarantees identification is telling you something about its reporting, not its capability.
It does not use access we do not have
No intrusion, no pretexting, no impersonation, no purchased account access. Everything comes from sources we are entitled to use, because a finding obtained any other way is worthless to counsel and dangerous to the client.
It does not confuse a lead with a finding
Single-source identifications are reported as single-source. Confidence is stated on every attribution, and where two candidates remain, both are named as candidates rather than one being chosen for narrative comfort.
It does not become the response
We do not contact actors, negotiate, or intervene. The report goes to the client and to whoever they have chosen to act: counsel, platform trust and safety, an executive protection team, or law enforcement.
It does not run in isolation
Groundtruth answers what monitoring surfaced and feeds what reduction acts on. An attribution that does not change the protective posture around a client is trivia.
Bring us the thing that escalated.
Groundtruth is available as a one-time investigation or a retainer.
A confidential call comes first, and it is short. We need to know what happened, what you already have, and what you would want to be able to do with an answer. Some matters we decline, and we say so on that call rather than after taking a retainer.
Where the work is directed by counsel it may be covered by privilege, depending on how the engagement is structured, and we can introduce qualified outside counsel where none is in place.
- Phone
- 855.76.ERASE
- info@obscureiq.com
- Counsel
- Introductions on request
- Handling
- Encrypted intake. Off the record by default.