Threat Intelligence
Monitoring, attribution support, and early-warning research on actors, campaigns, and emerging risks to people, brands, and assets.
CASE FILE — INTAKE
Everything leaves a trace.
I follow it.
Independent open-source intelligence analyst. I turn scattered public signals into verified, decision-ready intelligence — quietly, lawfully, and on your deadline.
§ 01 — Capabilities
What I'm engaged to find.
Every engagement begins with a question. These are the ones I'm asked most often — but the methodology adapts to whatever the file requires.
Background Investigations
Discreet due-diligence profiles on individuals and entities — for hiring, partnerships, litigation, or peace of mind — built from public and proprietary open sources.
Locating Persons of Interest
Skip-tracing and footprint reconstruction to surface current, verifiable points of contact when a subject has gone quiet or dark.
Website & Infrastructure Investigations
Unmasking the people and infrastructure behind a domain, store, or campaign — ownership, hosting, history, and connected entities.
Online Harassment Investigations
Identifying anonymous actors and documenting abuse into evidence packages your attorney or law enforcement can act on.
…and the cases that don't fit a category
Asset tracing, social-engineering risk assessments, executive exposure audits, fact-checking, and bespoke research. Describe yours →
§ 02 — Tradecraft
Quiet, methodical, defensible.
Good intelligence isn't about access you shouldn't have. It's about reading what's already in the open more carefully than anyone else bothers to.
-
01
Intake & scoping
We define the question, the constraints, and what a successful answer looks like. You get a fixed scope before any work begins.
-
02
Collection
Structured sweeps across public records, the indexed and archived web, breach-corpus references, imagery, and platform footprints.
-
03
Verification
Nothing reaches your report on a single source. Findings are corroborated, behaviorally matched, and graded for confidence.
-
04
Delivery
A clear, sourced report — confidence levels, an evidence appendix, and recommended next steps. Briefed live if you want it.
SCOPE & ETHICS
Strictly open-source and lawful. No hacking, no unauthorized access, no pretexting into protected accounts, no stalking. I work for clients with a legitimate interest and turn down what doesn't pass that bar. Discretion is mutual — your matter stays yours.
§ 03 — Credentials
Verified, not just claimed.
GIAC Open Source Intelligence (GOSI)
Formal certification in structured OSINT collection, analysis, and reporting tradecraft. The verifiable digital badge is shown here — live credential verification available on request.
- Methodical, documented collection
- Source evaluation & confidence grading
- Analyst-grade reporting standards
§ 04 — Open a file
Tell me what you need found.
Initial consultations are confidential and obligation-free. Reach out with a short description of the matter — no sensitive details in first contact, please.
DIRECT gnorwood@darkwater-research.com
PAYMENT ACCEPTED
- XMR Monero preferred
- BTC Bitcoin
- USDT Tether ERC-20 / TRC-20
Wallet details & invoicing provided on engagement. Conventional invoicing available for corporate clients.