ATTACK ATTRIBUTION · BOCA RATON, FL
Identification of the Origin of Internet Attacks
Two very different people arrive on this page, and both are asking a version of the same question.
Enetsec traces internet attacks, fraudulent accounts and anonymous activity back to their origin. We work from log data, headers, device artifacts and platform records. The laboratory has analyzed more than 6,000 cases since 1999. Call (561) 846-9010 in Boca Raton, Florida to start an attribution examination.
One runs a company. Something got into the network, and knowing that it has been contained is not enough. He needs to know how it got in, which account was used, whether the access is really closed, and whether he is looking at an outsider or someone with a badge.
The other is a private person. There is an account using her photographs. Someone is sending messages. She wants a name.
Both questions are answerable from the same discipline: attribution. It is the work of following digital traces backward until they resolve into a source you can document.
How We Trace an Attack Back to Its Origin
Attribution is not one technique. It is the accumulation of small, individually weak signals into a picture that holds together.
We work from server and application logs, authentication records, firewall and VPN records, email headers and message metadata, IP allocation and hosting records, domain registration history, payment and platform account artifacts, and the device artifacts left on any endpoint we can image. Each source has a retention limit, which is why timing matters so much. Some records are gone in a week.
Where a device is available to us, it usually tells the clearest story. When we examine a phone or a laptop, the first thing we look for is not the obvious file. It is the timeline: what account signed in, from where, at what moment, and what changed on the machine immediately afterward.
For Companies: Who Breached Us, and From Where
After an intrusion your obligations do not end with recovery. Your insurer wants a cause. Your counsel wants a defensible narrative. Regulators and customers may need a notification that is accurate rather than optimistic.
We reconstruct initial access, establish the path the intruder took through the environment, identify the credentials and systems involved, and determine whether data left the network. In several matters we have worked, the initial access point was an account belonging to a former employee that nobody had disabled. That is not a technology failure. It is a records failure, and it shows up only when someone reads the logs properly.
We also look carefully at the insider question, because it changes everything about how the matter is handled. Where the evidence supports an internal source, we document it. Where it does not, we say so plainly rather than leaving an accusation hanging.
For Individuals: Who Is Behind This Account
If someone has built a fake profile using your name or your photographs, you are dealing with a person who is counting on being unreachable. Usually they are not.
Fake accounts leave traces. Reused images carry origins. Account creation leaves timestamps and often a device fingerprint. Message patterns repeat across profiles. Payment requests connect to real instruments. In our experience, people running these accounts are rarely careful, because they have never been examined before.
THE BOUNDARY
We document what we find in a written report you can take to a platform, to an attorney, or to law enforcement. We do not contact the person on your behalf and we do not access anyone’s device or account without lawful authority. Everything we produce comes from records we are permitted to obtain and examine.
What Our Clients Say
ON THE RECORD
“Within a few days, they uncovered the truth: the photos were stolen, the identity was fake, and the person behind it had a history of scamming people just like me.”
What You Receive
A written examination report describing the sources examined, the method used, the findings, and the limits of those findings. Supporting exhibits with hash values. A chain-of-custody record for anything we took possession of. Where the matter proceeds, a certified examiner who can be deposed on the work.
Attribution work supports and is supported by the wider response. If you are dealing with an active event, start with incident response for ransomware, because preservation comes before tracing. If you want to close the gaps the attacker used, see our digital security assessment work.
Elsewhere in Incident Response
Frequently Asked Questions
NO. 1 Do you take cases nationwide, or only in Florida?
We take cases nationwide and internationally. The laboratory is in Boca Raton, Florida, and we work onsite across South Florida including West Palm Beach and Fort Lauderdale. Beyond that, most attribution work is record-based and can be performed remotely, with physical media shipped under seal when a device examination is required. Enetsec has operated since 1999 with work spanning the United States and Brazil, so cross-border matters are routine for us rather than an exception.
NO. 2 Can you recover deleted text messages, photos, and files?
Often, yes, and how often depends on the device, the operating system version, how much time has passed and how heavily the device has been used since deletion. Deleted data survives until the space it occupied is overwritten, which is why we ask you to stop using the device immediately. We do not promise recovery of any specific item before examination. What we do commit to is a documented, reproducible attempt and an honest report of what was and was not recoverable.
NO. 3 What is cell site analysis and CDR mapping used for?
Call detail records show which cell sites a phone connected to and when. Mapped against tower locations and sector coverage, they place a device in a general area over time. That supports or undermines a claimed location, corroborates a timeline, or connects two devices to the same place. It is approximate by nature. Cell site analysis narrows a location to a coverage area, not to an address, and any examiner who tells you otherwise is overstating the method.
NO. 4 Do you work cases for regular people, or only for law firms?
Both. Roughly half of what this laboratory handles comes from individuals and families rather than from counsel or corporations. Fake accounts, romance fraud, stolen images, harassment and account takeover are ordinary work for us. You do not need an attorney to hire us, and you do not need to know the technical language. Call (561) 846-9010, describe what happened in plain terms, and we will tell you what can and cannot be examined.
NO. 5 What do I get at the end of the examination?
A written report in plain language, with a technical appendix. It states what was examined, how it was acquired, what the method was, what was found, and what the findings do not support. Exhibits carry hash values so they can be verified independently. You also receive the chain-of-custody documentation. If the matter goes further, the same examiner who did the work is the person available for a declaration or a deposition.
Start an Attribution Examination
If records are still available, they will not be for long. Call (561) 846-9010 or reach the laboratory through our contact page, and we will tell you on the first call what can still be preserved.
Call (561) 846-9010, email [email protected], or start at /contact-us/. If an event is active, begin with incident response for ransomware, or close the gaps afterwards with digital security.
CONFIDENTIAL INTAKE MON–FRI 8:00 AM – 5:00 PM EN / PT / ES