What the work looks like
You get a cluster, for example 30 reports of fake parcel texts that our data shows share hosting and the same page template. Over a few weeks you work out how the operation runs: how people are contacted, which sites they are sent to, how payment is taken, and how many domains and victims are involved. You pull preserved evidence from Frontline and data from Longview as you go. The final piece explains the campaign and what to watch for, and is clear about what the evidence cannot show, such as who is behind it.
What you’ll do
- Investigate one campaign over weeks, not one report over days
- Follow the chain from first contact to the ask
- Establish how far the campaign reached
- State plainly what the evidence shows — and what it doesn't
- Spend about 20–30 minutes a day reviewing incoming reports with the rest of the team, and flag promising leads to your team lead.
What you’ll bring
- Patience for long, detailed work
- Data or OSINT experience
- Strong, careful writing
What you’ll get
- Published work with your name on it
- Hands-on time with real investigation tooling and data
- A path to running your own investigations