The intelligence layer around a digital incident
Many cyber-enabled incidents create questions that are not purely technical. A payment-diversion email, impersonation website or suspicious online identity may require research into domains, companies, people, public infrastructure and related activity before the broader picture is clear.
Carratu International focuses on that intelligence layer. The service complements cybersecurity and incident-response specialists rather than replacing technical containment, malware analysis or forensic examination of compromised systems.
Business email compromise and impersonation
Business email compromise commonly relies on targeted impersonation and knowledge of genuine business relationships. Research can help establish whether the apparent sender, domain, website or company identity is genuine, recently created, copied from a legitimate business or connected to other suspicious activity.
Typical areas of enquiry
- Impersonation domains, websites and misleading company identities.
- Domain history, registration indicators and publicly visible DNS or email-security context.
- Linked websites, profiles, aliases and online business identities.
- Consistency between digital claims and formal company or professional records.
- Public references to related scams, exposed information or malicious infrastructure.
- Relationship mapping and source-referenced chronology around the incident.
Digital footprint can assist both attackers and investigators
Public information about executives, suppliers, payment processes and business relationships can make targeted fraud more convincing. The same open-source context can also help reconstruct how an impersonation was designed and which details were copied, altered or invented.
What clients receive
Outputs may include a focused intelligence note, domain and identity comparison, chronology, relationship map or broader report. Findings distinguish confirmed technical or corporate facts from reasonable indicators and unknowns.
When specialist cyber response is also required
If an account or system may have been compromised, containment and forensic preservation should be handled by the organisation's IT, cyber-response or forensic specialists. Carratu International can then address the external identity, relationship and open-source questions in parallel.
Investigating an impersonation or cyber-enabled fraud?
Provide the suspicious domain, profile, message or entity together with a short incident summary. We can identify which external intelligence questions are capable of being answered from compliant sources.
Enquire now