Online Investigations
Online Investigations That Lead to Attribution
When monitoring and takedowns are not enough, our investigators go deeper. We investigate the individuals, companies, and infrastructure behind infringing activity, and build the evidence needed to act.
Intelligence Keeps the Enforcement Cycle Moving
Where Cases Originate
Many of our investigations begin with findings from our online monitoring and takedowns of illicit content and listings. Others come directly from clients, counsel, or our field investigators.
- Piracy networks and repeat offenders that keep returning after takedowns are flagged for additional investigation.
- As high-risk sellers and counterfeit networks operating across marketplaces and social platforms are identified, we move to investigate the infrastructure.
- Clients and counsel bring direct requests, from identifying an unknown operator to documenting a known infringer.
- Field investigators pass on leads that require online follow-up.
Escalation Review
We assess each case and determine next steps in collaboration with the client, so effort goes where it will have the most impact.
- Online investigations identify the people and infrastructure behind an operation.
- Test purchases confirm what is being sold and how payments are processed.
- Field investigators verify identities, addresses, and premises on the ground.
- Cases with strong evidence can move straight to enforcement action.
From Findings to Outcomes
Every investigation ends with a clear account of what was found and acted upon, with actionable intelligence that can strengthen further monitoring.
- Investigation reports detail what was found, what the evidence tells us about who is behind it, and our confidence in that conclusion.
- Recommended next steps name specific actions, such as targeted disruption, cease-and-desist letters, knock-and-talks, civil litigation, or criminal referrals, where the evidence supports.
- Evidence packages support civil litigation and criminal referrals to law enforcement.
- New identifiers and infrastructure can be used to strengthen online monitoring, enabling future detection.
How We Turn Information Into Intelligence
The Intelligence Cycle
Data is not intelligence until it answers a question.
A domain registration date, a social media profile, or a hosting provider is only information. Intelligence explains what it means and what to do about it: whether apparently separate incidents are connected, who may be responsible, and where action could have the greatest impact. Every investigation we run follows the intelligence cycle, and every product we deliver is held to five standards:
- Timely: delivered while the decision is still open
- Accurate: sourced findings with clear confidence levels
- Relevant: focused on the question the client asked
- Forward-looking: assesses how an operation may respond to enforcement
- Actionable: names specific targets and next steps supported by the evidence
Four phases, from question to answer.
Direction
Every investigation starts with the client’s question. We define what they need to know, which decisions depend on the answer, and any constraints of time, budget, or jurisdiction, then translate that into specific investigative objectives.
Collection
We gather information from relevant open sources, business and court registries, specialist databases, and case-specific investigative activity. Every item is captured with its source and date.
Processing & Analysis
We organize the data and interpret it: recognizing patterns, cross-referencing identifiers, testing hypotheses, and reconstructing timelines. We actively look for evidence that could prove us wrong, and state how confident we are in each conclusion.
Dissemination
We deliver findings in a clear report, written so that an executive and a lawyer can both act on them, with recommended next steps tied to the evidence.
Read Our Latest Report
IP House and Digital Citizens Alliance Expose How Global Piracy Networks Operate as Organized Crime Syndicates
Cross-Border Investigations
Find the strongest path to action, even when the operation spans multiple countries.
Illicit online operations often spread their people, companies, infrastructure, and payment channels across different jurisdictions. We connect those pieces so clients can see where the operation is actually concentrated, which entities matter most, and where enforcement may have the best chance of creating change.
- Identify the countries, companies, service providers, and individuals most relevant to the case
- Show which jurisdictions connect the operator, infrastructure, payments, and corporate entities
- Prioritize the entities or locations that offer the clearest enforcement opportunity
- Flag where additional records, local counsel, field work, or legal process may be applicable
- Distinguish strong jurisdictional links from weaker or unconfirmed connections
- Give clients and counsel a practical basis for deciding where to enforce
Stay in control of your brand,
anywhere it lives.
Our experts are here to help you assess your IP protection needs.
Uncover the Source