DELIVERABLE SPECIFICATION // TARGETED OSINT REPORT
Inside a Targeted OSINT Report for Private Investigators.
Every report is structured so you can quickly evaluate the technical findings, see the exact sources used, and understand the next investigative pivot—without wading through raw tool dumps.
Focused Scope & Casework Objective
A written statement of the investigative question, PI-supplied identifiers, and practical boundaries agreed upon before research begins.
Primary Investigative Question
Determine whether anonymous harassment emails, a lookalike domain, and an online alias share technical infrastructure orfootprint links with known case subjects.
PI-Supplied Material
Two raw email files (.eml), target domain [REDACTED-PARTNERS-LLC.NET], subject username handle, and field chronology.
Methodological Boundary
Lawful open-source, passive DNS, RFC-5322 header analysis, and commercial intelligence databases. Discreet behind-the-scenes support.
Value to Your Casework: Keeps technical subcontracting focused, predictable, and directly aligned with your client’s budget and objective.
Documented Sources & Observation Log
Every technical source, lookup timestamp, and artifact hash is documented so you can stand behind the findings in your client reporting.
Supplied Artifact Integrity
harassment-msg-01.eml & 02.eml (SHA-256 hashes logged at intake; full RFC-5322 headers preserved).
Infrastructure & OSINT Sources
Historical WHOIS/RDAP records, Passive DNS A/MX/TXT history, TLS certificate logs, and cross-platform handle archives.
Verification Standard
All findings cross-referenced across multiple independent sources with UTC observation timestamps.
Value to Your Casework: Gives you a clean, verifiable audit trail to incorporate into your master case file.
Findings, Technical Analysis & Correlation
Actionable synthesis showing how digital indicators connect—giving you concrete pivot points for your investigation.
Finding 3.1 (Header & Timezone)
Received hops show both emails were submitted via a privacy relay, but client-side Message-ID and Date headers consistently reflect UTC-05:00 workstation clock settings matching the subject’s operating region.
Finding 3.2 (Infrastructure Pivot)
Archived DNS and TLS records link [REDACTED-PARTNERS-LLC.NET] to a secondary domain whose historical registrant email matches the exact username handle supplied from fieldwork.
Investigative Implication
Establishes a corroborated technical bridge between the anonymous domain and the known online handle.
Value to Your Casework: Turns scattered technical artifacts into concrete investigative leads you can act on immediately.
Explicit Limitations & Recommended Next Steps
Honest documentation of technical boundaries so you never overpromise a result to your client.
IP & Relay Caveat
Outbound mail relay IP [198.51.100.88] belongs to a commercial VPN exit node; the IP alone does not identify a physical street address.
Attribution Boundary
While historical DNS and handle reuse link the secondary domain to the subject’s alias, current registrar records are privacy-shielded.
Recommended Next Step
Use the newly identified secondary domain and archived business phone number to pivot into local commercial/corporate filings.
Value to Your Casework: Protects your reputation with clients by separating verified technical facts from inference.