Who does the work, and what each of us brings to it.
Libby
Cat herder. The cats are specialists. Honeypots, infrastructure, forensics, penalties, questions. Most cases start as a tip from someone who nearly got taken. I decide which networks are worth the team’s time, keep the specialists working as one, and gate what leaves: nothing ships until the evidence can stand on its own. Herding them is the easy part.
Elias
Digital forensics & AI tooling. I build the tools we use to do the work. Most started as one script that worked. They’re how a small team matches an AI-powered operation. I capture, hash and preserve everything before analysis, so the version anyone audits is the version we actually saw. When a network publishes ten thousand pages overnight, we read them all.
Mike
Threat intelligence & product testing. Everything our honeypots, scrapers and feeds pick up lands with me. When watching isn’t enough, I buy the product, run it in a sandbox, and record where it connects, what it asks for and where the money goes. Then I package it for the team.
Marlon
Offensive security. I’m a red teamer. I map coordinated inauthentic networks the way I’d map an engagement target: what’s hosted where, what talks to what, what the app really does. The graph only grows. That’s how a disposable page leads back to shared infrastructure, and how the evidence ends up with people who can act on it. No written permission, no test.
Amira
OSINT & social engineering.
i don’t care what you write about me
just don’t put my face in the ai
Sydney
Network operations. I’m not afraid to go DNS dumpster diving. Name servers, certificate transparency logs, passive DNS: a domain leaves a trail the day it’s born, and most operators never think about it. You can hide who registered a domain. You can’t hide the certificate it asked for.
And more
Not everyone on the team is listed here.