Breach index
REC 001 · 1.2s · 153 recordsemailjohnsmith@gmail.com
password••••••••••••
sourceCollection #1 · 2019
Open-source intelligence,
worked like
a case file.
We are an independent, analyst-led investigations practice. Our researchers examine public records, corporate filings, domain history and online footprints, then corroborate material findings and deliver a clear, source-linked case record.
scoped in writingsources attached
analyst-reviewedretention on request
Client access
Enter the workspace
New accounts start on the Free tier: 10 searches, redacted results. Access is per operator.
Keys are personal. Sharing a key is grounds for revocation.
By registering you accept the standards below.
By registering you accept the standards below.
Three kinds of work
Most instructions fall into one of three buckets. Each one is scoped in writing before a single source is queried, so you know what we will and will not touch.
Corporate & counterparty diligence
925+
source checks
Who is behind a company, a domain or an inbox. Registry filings, domain history, mail patterns, breach exposure and the human accounts attached to them.
registry datadomain historybreach exposuremail patternslinked accounts
Fraud, ATO & threat triage
303+
source checks
When an account is taken over or a payment is disputed: line and carrier data, registration footprint, exposure history and the pivots that connect them.
carrier & lineexposure historyregistration footprinttimelineattribution
Identity & missing-person tracing
2.1k+
platform profiles
Reconnecting a handle to a person: profiles across social, gaming, streaming and messaging, cross-platform pivots, and a documented trail of what we found where.
socialgamingstreamingmessagingavatar trails
Illustrative walkthrough · synthetic data
How a lookup is worked.
Open Source Sol — workspace
LIFETIME · ∞
⌕
enter a target
Run
StatusReady
Results0
Matches0
Entities0
MATCH
Social accounts
REC 002 · 2.8s · 6 profilesinstagram@johnsmith · 2014
steamsteamcommunity.com/id/johnsmith
twitchtwitch.tv/johnsmithlive
Phone intelligence
REC 001 · 0.9s · Verizon WirelesscarrierVerizon Wireless
line typeMobile · United States
riskMedium · 42 / 100
CNAME lookup
REC 002 · parallel · 9 linkedType an identifier
Type
Email results
Parallel phone + CNAME
Complete
Casework
A case,
A case,
not a chat.
Every instruction runs the same way. We agree the question in writing, collect only what the question needs, corroborate before we assert anything, and deliver a report with the sources attached. A named analyst owns the file from intake to sign-off.
- ✓Scoping memo before any source is queried
- ✓Two-source rule on anything we put in a report
- ✓Sourced PDF, workspace access, and a debrief call
Source coverage
Sources we work with.
Public records, breach indexes and platform footprints. Coverage depends on the identifier, the jurisdiction and the platform’s own terms — we say so in the report when a source is unavailable.
Scroll to switch category →
Method
Built for casework, not screenshots.
A finding is only useful if you can defend it six months later. The workspace keeps the trail — what was checked, when, against which source family, and who signed it off.
Scoping and intake
The question, the lawful basis and the identifiers in scope are written down before anything runs. Work outside that scope is refused in writing.
scoping memolawful basis
Parallel collection
One identifier, several source families, one captured run. Phone and infrastructure checks dispatch together instead of living in separate tabs.
single runper-source timing
Corroboration
A single hit is a lead, not a finding. Anything that reaches a report carries a second source or is explicitly labelled unconfirmed.
two-source ruleconfidence notes
Source-annotated export
Every record keeps its source family, timestamp and query. CSV and JSON exports carry the same annotations as the screen.
CSVJSONcitation trail
Case files and evidence
Notes, images, saved result sets and manifests live in one case file. The file you hand over is the file you worked from.
case notesimage evidencePDF report
Access and separation
Keys are issued per operator. Sessions are HTTP-only cookies, and administrative actions sit apart from analyst work.
per-operator keysadmin registry
Capability index
What we can run.
This is the capability index, not a menu. Only the checks the scope allows are run against an identifier, and anything unavailable at the time is disclosed in the report.
Identifier search
Email, phone, username, domain and IP runs, with per-identifier placeholders and a keyboard-first workflow.
EmailPhoneUsernameDomainIP address
Breach and stealer records
Archived breach data, stealer-log credentials and machine manifests, handled for authorized fraud, legal and law-enforcement work.
Breach indexStealer logsMachine manifestsCredential searchFile search
Account and platform pivots
Public presence across gaming, messaging, mail and infrastructure identifiers, with the profile URL kept for every hit.
IP infoSteamXboxDiscordRobloxHoleheGHuntSubdomains
Identity and leak pivots
Cross-platform identity work and credential-exposure checks, with source labels on every row.
Discord → RobloxPrevious handlesLeak indexCredential search
Infrastructure and phone footprint
Hosting, CNAME and phone footprint checks, dispatched alongside the primary identifier rather than as an afterthought.
CNAMEPhonebookRisk notesLinked categories
Workspace
Entity graph, recent-search replay, diagnostics and request logs — kept for the life of the case, then disposed of on request.
Entity graphRecent runsDiagnosticsRequest log
Workspace capability register
One workspace. A broad source set.
The workspace brings identifier lookups, records research, platform pivots, media review and investigation tools into one analyst console. Availability depends on account tier, source availability and the scope of the investigation.
50+workspace tools
& modules
& modules
01 / Identifiers
Identity & contact intelligence
Start from a known identifier and review related records, account presence and supporting source references.
02 / Exposure research
Breach, exposure & archive search
Review indexed exposure records, credential references, machine manifests and archived material within authorized casework.
03 / Platforms
Social & platform pivots
Check public-facing account identifiers across messaging, social, gaming and community platforms.
04 / Infrastructure
Network, domain & public records
Connect infrastructure indicators with domain, address, vehicle and jurisdictional record checks.
05 / Media & location
Image, geolocation & media review
Inspect image metadata, evaluate location clues and organize visual evidence for analyst review.
06 / Case operations
Investigation workspace & reporting
Keep research organized with linked entities, saved investigations, monitoring, workflow steps and exportable reporting.
* People search requires the Investigator plan or above (Lifetime included). SSN-enabled rows are limited to Investigator and Lifetime.
Request workspace access →
Selected engagements
Work we can talk about.
Client names are withheld under engagement confidentiality. Sector, brief and outcome only. Identifying details are changed where necessary.
Legal · pre-litigation
“Counsel needed the ownership trail behind a contested domain before a filing deadline. We mapped the registrant history, the linked inboxes and the two people behind both. Delivered in four working days with sources attached.”
CO
CounselCommercial litigation · UK
Insurance · claims
“A motor claim with inconsistent account details. We traced the phone and email to a cluster of prior claims and documented the overlap. The file went to the insurer’s SIU with a corroborated timeline.”
SI
Special investigations unitClaims · EU
Fintech · onboarding
“A merchant application that did not survive our standard checks. We confirmed a synthetic identity pattern across four registrations and wrote it up in a form their compliance team could file as-is.”
RC
Risk & compliancePayments · APAC
Retail · brand protection
“Counterfeit storefronts kept reappearing under new handles. We linked the storefronts to one operator through shared infrastructure and payout identifiers, then handed the bundle to their counsel.”
BP
Brand protectionConsumer goods · US
Private client · tracing
“A family asked us to find someone who had been out of contact for years. We worked only public sources, kept the family informed at each stage, and closed the file when the person asked not to be contacted.”
PC
Private instructionTracing · UK
Platform · trust & safety
“Repeat ban evasion across gaming and messaging platforms. We produced an account cluster with the evidence for each link, plus the rows we could not corroborate — so their team knew exactly what was solid.”
TS
Trust & safetyPlatform · remote
Fee schedule
What access costs.
Access plans are per operator and unlock the full capability index. Retained engagement work — scoping, collection, corroboration, report — is quoted separately once we understand the question. Need programmatic access? The API plan issues bearer keys for the same modules at $60/month.
People search is included from Investigator up — Lifetime includes it, and administrator-issued custom plans can be granted it individually.
Evaluation
$0
10 searches
- Redacted results
- All source families
- Entity graph
- No card required
Sole practitioner
$5/mo
- 35 searches
- Unredacted results
- CSV + JSON export
- Email support
Team
popular
$15/mo
- 60 searches
- Unredacted results
- Priority dispatch
- Case notes & evidence
Case-heavy
$25/mo
- 120 searches
- Unredacted results
- People search included
- Deep record drill-down
- Exportable case files
Lifetime
$50/one time
- Unlimited searches
- People search included
- All source families
- Unredacted results
- No renewal
API
programmatic
$60/mo
- 20,000 calls / month
- Every module endpoint
- Bearer keys · 240 req/min
- Revoke anytime · hashed keys
- API reference ↗
Retained engagements
Scoped per matter, quoted before work starts. Enquiries: Telegram @focusonwywjax
Fees in USD · credits refresh every 24 hours and do not accumulate
Standards
How we handle data and access.
Plain-language terms, written the way we would explain them on a call. By signing in you agree to everything below. If a clause needs changing for your matter, raise it before you register.
Terms of Service tos
1. Eligibility. Access is granted to a single operator per access key. Keys are personal, expire after the period shown in your workspace, and may not be shared, resold, or published.
2. Authorized use. You may use the workspace only for lawful investigations, fraud prevention, security research, or other purposes you are legally permitted to pursue. You are responsible for the legality of each query in your jurisdiction.
3. Service. Modules depend on third-party sources and may be unavailable, rate-limited, or return no record. Results are provided as-is, without warranty of accuracy or completeness.
4. Suspension. Accounts may be locked or removed for abuse, key sharing, evasion of rate limits, or violation of these terms.
Privacy Policy privacy
What we store. Your username, access key, plan, credit balance, key expiry and usage counters. That's it. Queries are not logged by the server or written to the database.
Where it lives. Account records are stored in a Neon Postgres database. Sessions are HTTP-only cookies; the admin session is separate and expires after 12 hours.
What we don't do. We don't sell data, run advertising trackers, or share account records with third parties. Data-source providers receive the query only when you run a lookup.
Acceptable Use aup
Permitted. Fraud checks, account recovery, KYC support, threat intelligence, red-team research with authorization, and law-enforcement work.
Prohibited. Harassment, stalking, doxxing, extortion, unauthorized access to accounts, identity theft, or any use that violates applicable law. Do not use the workspace to target minors or to build profiles for harm.
We may refuse or revoke access where use appears abusive, without notice.
Billing & Refunds billing
Plans. Free includes 10 searches with redacted results. Paid plans add search credits; Lifetime is unlimited. Credits refresh every 24 hours to the plan allowance and do not accumulate.
Custom plans. Set manually by an administrator with a name, credit amount, key duration and key value.
Refunds. Consumed credits and expired custom periods are non-refundable. If a plan was purchased in error and no searches were used, contact the administrator within 48 hours.
Data & Retention data
Queries are processed in memory and shown only in your session. Exporting results (JSON/CSV) writes the file to your machine, not to the server. Case files you create in the workspace stay in that browser unless you export them.
Deleting an account removes its record and key immediately. Backups, if any, roll off within 30 days.