Citizen Lab just published "Exposing AdFection," showing how Israeli ad-tech firm Discover-Tech bought targeted ads that delivered Candiru spyware. At least 45 devices inside Al Jazeera were targeted. The findings are big, but the method is what I'd bookmark.

They wrote regex fingerprints for the HTTP banners on Candiru's validator servers and ran them across monthly Censys snapshots, which turned up 305 domains on 319 IPs from August 2022 to July 2026. The Controlium login page shipped its full frontend source, so they rebuilt the admin interface without ever logging in. Passive DNS and CNAME records tied the domains to a load balancer named for Discover-Tech, and two world-readable Apache Druid databases held about four billion bid records, showing the ads ran on almost 200,000 sites and apps between March and June 2026. Archived urlscan pages filled in how the ad tags were actually deployed.

Nearly every step uses open data or something the operator left exposed, and they're clear about where they stopped, including an auth flaw they chose not to test. Lots here to borrow for your own infrastructure work. Confiant put out a companion investigation the same day.

Joseph Cox at 404 Media, working with Court Watch, found a Telegram letter sitting in a federal court docket in Louisiana. It's Telegram's reply to a Stored Communications Act order in the case of a Gaza man charged over alleged involvement in the October 7 attacks. The return is short: user ID, phone number, display name, one IP address and a timestamp.

The wording is the part I found most interesting. Telegram says it provided the data "voluntarily" and that this isn't "conceding that we are subject to U.S. jurisdiction." Since Pavel Durov's arrest in France in August 2024, Telegram has gone from rarely answering these requests to answering them routinely. An earlier 404 Media report counted 2,253 users whose data it gave US authorities in 2024.

If you ever have to explain what's realistically recoverable from a Telegram account through legal process, this is a rare look at a real return. The court PDF is linked in the piece.

Henk van Ess has a new research guide on GIJN, and it's one of the more practical walkthroughs I've seen in a while. His test case is China's footprint in Ghana. He finds the country domain (gov.gh), checks with filetype:pdf whether it's worth searching, then searches in Chinese ("中国人") on Ghanaian sites. When the Energy Commission's pages turned out to be dead, he pulled the full list of captured URLs from the Wayback Machine, filtered it for "china," and recovered six PDFs from October 2020.

Then he flips it round. He searched 加纳 (Ghana in Chinese) on site:gov.cn and found an 89-page MOFCOM investor guide. He ran that through NotebookLM, then had a second model check the figures against the Chinese original, and it caught three framing problems. There's also a nice expert-finding trick: add /recommendations to a Substack URL and keep hopping. He also flags that Google's inurl: operator doesn't seem to behave properly anymore, which is worth testing for yourself.

OCCRP, De Tijd and Knack followed the Dubai money of Nasserdine Tarrahi, a senior figure in Antwerp's "Turtles" gang. Between 2019 and 2021 he bought six Dubai properties for $6.2 million. Three Grand Bleu Tower flats cost $3.8 million and sold for $6.6 million about three years later. A Bluewaters unit he bought for $1.6 million went for over $4 million. In February 2023, about a year after his second Belgian conviction, he got a ten-year property-owner visa. Dubai extradited him to Belgium yesterday.

For practitioners, the useful part is how it was pieced together. The reporters used the Dubai Unlocked property data, a Dubai Land Department scrape, facilities management records (one unit was still being charged service fees in early 2026) and UAE visa records, then checked them against Belgian court verdicts. Belgium's seizure office confirmed it hasn't seized any of his Dubai real estate. It's a good reminder that you have to find the assets before anyone can freeze them.

DFRLab, FIP.am, LetsData and Erebus just published their work on the networks that pushed war fears and the "300,000 Azerbaijanis" resettlement claim ahead of Armenia's June election. What makes it worth reading is the method. They tested coordination and inauthenticity separately: coordination from behaviour, inauthenticity from how the pages presented themselves.

For the websites they used shared AdSense publisher IDs, near-consecutive Yandex Metrica IDs (which suggest a batch of sites built at once), a shared admin login, a shared hosting IP, and byte-identical images going up seconds apart. In one case the same photo appeared on seven sites within about 2 minutes 46 seconds. For Telegram they counted how often channel pairs posted the same item within a minute and compared that with a shuffled baseline of each channel's own timeline. One pair matched on 572 posts, 374 of them in the same second.

The toolkit is mostly free or familiar: DNSlytics, BuiltWith, the Wayback Machine, TGStat, archive.ph, plus Junkipedia and the Meta Content Library. They're also careful to say that a shared developer or ad account doesn't prove common control on its own. It's the stack of signals that does the work. That shuffled-baseline test is something I'd like to borrow.

Matthew Gault at 404 Media, working with Court Watch, dug up a nice detail in a Milwaukee drug case. On Halloween 2025 a Homeland Security Investigations agent filed a warrant application of more than 60 pages to put a tracking device on a suspect's white Tesla. A judge signed it the same day. The device never went on.

The agent's return note says it all: "Search warrant not executed due to security protocols active on Tesla." The filing doesn't say which protocols. Sentry Mode is the obvious suspect, since it flashes the lights, sounds an alarm, records on the exterior cameras and pings the owner when someone gets close.

I like this one as a reminder of what's sitting in court records. Warrant returns often tell you more about how surveillance actually plays out than the applications do, and the filing is up on CourtListener if you want to read it yourself.

Joseph Cox at 404 Media reports that Graylark Technologies has added interior analysis to Raven, its AI geolocation tool that used to be called GeoSpy. You upload one photo of a room, choose an interior and exterior search, pick a region, and it returns a map location plus matching properties. In the company's demos those matches were Airbnb, Vrbo and Zillow listings. It doesn't use metadata and it isn't a reverse image search. It picks out distinctive features in the room and finds other photos of the same property, even ones taken at different times. LAPD and the Miami-Dade Sheriff's Office have bought access.

The technique isn't new. Lots of investigators already match rooms against listing photos by hand, and this automates that. Keep the caveats in mind though. A Miami-Dade spokesperson told 404 Media its use has been limited and exploratory, with no arrests driven by the tool alone. It's also unclear whether the demos reflect real-world accuracy. Airbnb and Zillow both say scraping breaks their terms.

It's also a good opsec reminder. If you or a source share photos from inside a home or a rental, assume the room alone could place you. Worth adding to your photo-sharing checklist.

Human Rights Watch, ARTICLE 19, İFÖD and 18 other groups put out a joint release yesterday on Türkiye's latest round of account blocking. İFÖD counted orders against at least 1,270 X accounts in September, with 35 million followers between them. X complied with at least 90% of those orders by geo-blocking, so the content is only hidden inside Türkiye. T24's website and its X account (1.9 million followers) were blocked on September 29, and when it changed its handle twice the new one got blocked too. Bianet, Kısa Dalga, Amnesty Türkiye and MLSA are affected as well, along with İFÖD's own account and the Engelliweb monitoring account.

Most of the orders rely on Article 8/A of the Internet Law. It lets the executive block content in "urgent" cases, with a Criminal Peace Judgeship reviewing afterwards. Since July those powers sit with a Cybersecurity Directorate attached to the presidency. Users mostly get a bare "withheld" notice without the order behind it, which makes appeals hard.

If you monitor Turkish sources, it's worth checking how your setup looks from inside and outside the country, and archiving the accounts you rely on before they go dark. İFÖD's monthly reports and Engelliweb are the ones to follow for the running count.

Ian Urbina wrote up the method behind The Outlaw Ocean Project's Food for Feed investigation for GIJN. It's a solid template for any big supply chain story. The team found more than 1,400 fishmeal factories in 64 countries and assessed more than 2,400 ships tied to fishmeal production. Coders scraped and structured government databases. Researchers tracked local news, court records and social media, and reporters made six voyages and visited sites in nine countries.

Two things I'd borrow. First, every claim in the stories is footnoted with archived links to the underlying documents and data. Second, they sent their findings and methodology to more than 400 companies, agencies and certifiers months before publication, then published the exchanges.

They also built Bait to Plate, a platform that links reports on ships, plants and companies so you can follow a supply chain. It has a bot that turns plain-language questions into live database queries. Have a poke around if you work on seafood, sanctions or forced labour.

OCCRP, the Bureau of Investigative Journalism (TBIJ) and CIReN went back into the Cyprus Confidential files. They found Deloitte Cyprus and MeritServus, its former division, allegedly helping firms linked to Roman Abramovich move bank deposits, yachts and property into British Virgin Islands companies. They did it with paperwork dated years before it was written. TBIJ counts more than 1,000 backdated records across more than 100 companies, covering 1999 to 2013.

The part I like most is how they showed the dates were wrong. Emails from 2005 and 2006 discuss creating documents dated 2003. A sale agreement dated January 2003 was drafted in November 2006. A UK subsidiary's public accounts named the Cypriot Electus as its parent in 2003 and 2004, which contradicts the later claim that a BVI company owned it. In the piece's words, that record "simply could not be rewritten."

Abramovich's lawyers deny wrongdoing, and Deloitte Cyprus says it "acts in compliance with applicable laws." Good reminder that the dull filings sitting in someone else's registry are often what holds up.

IKEA pulled out of Russia and Belarus in 2022 and told its suppliers to do the same. Novus Industry, a Belarusian factory that used to make furniture for IKEA through a Lithuanian supplier, kept shipping to Russia anyway. The Belarusian Investigative Center and Lithuania's 15min set out to show how close that furniture still is to IKEA's. Their method works well as a template for any lookalike or sanctions-adjacent product story.

They put Novus catalogue images next to IKEA's own product pages. Then they asked Cecilia Wahlberg, an industrial design lecturer at Konstfack in Sweden, to review them. She found some pieces unlikely to infringe, but others showed "apparent similarities in the design and measurements." She suggested the same production drawings and machinery might still be in use. One Russian retailer's site even pitched the range as an IKEA substitute with the same design and quality. Belarusian customs data then put a number on it: more than $30 million in direct exports to Russia between March 2023 and May 2025.

My takeaway is that retailer marketing copy counts as evidence. When a seller names the brand it's replacing, capture and archive the page before it gets edited. For balance: IKEA says it found no sign that its supplier broke sanctions, and Novus says it builds to its customers' designs.

If you follow Russian milblogger Telegram, you know Rybar. On Friday Montenegrin police detained its founder Mikhail Zvinchuk, his wife Valeriya and three others at a hotel in Risan, less than two days after they arrived. Their residency was revoked on national security grounds and they were ordered out. Officers also seized a drone, high-res cameras, GoPros and several phones, which have gone to prosecutors in Podgorica and Kotor for forensic analysis.

What I like about Zdravko Ljubas's write-up is how much context it gathers in one place. The UK has sanctioned Zvinchuk and Rybar LLC. The US Rewards for Justice programme offers up to $10 million for information on Rybar's leadership and names Rybar LLC and 19 individuals. According to that notice, Rybar was first funded by Prigozhin and is now funded by Rostec. ISW has cited Zvinchuk claiming Rybar ran more than 250 channels in 28 languages.

Rybar says the team was there legally to film at Cetinje Monastery. I'll be watching the seized devices. If any of that forensic work becomes public, it could be one of the most detailed looks yet at how the operation works on the ground.

Alexios Mantzarlis at Indicator just put out a guide to investigating sockpuppets and manipulation on Wikipedia. It starts from a good number: Wikipedia's own data flags almost 28,000 users as "sockmasters," meaning people who run two or more accounts to deceive.

He opens with Claire Wilmot's investigation from January. It uncovered a decade-long effort by London PR firm Portland Communications to edit Wikipedia deceptively through a contractor. Wilmot says Wikipedia's public records gave her a "huge body of evidence that could corroborate what my sources were saying." From there the guide covers Wikipedia's sockpuppet policy, the data and tools investigators can use, and tips from five journalists, researchers and Wikipedia editors.

Heads up that the full guide is for Indicator members. If you've done Wikipedia edit-history work, what's worked for you?

It's been five years since the Pandora Papers, and Brenda Medina at ICIJ went back to see what happened to all the promised transparency. Short version: a lot of it has been walked back. In the US, Treasury exempted more than 99% of companies from the Corporate Transparency Act in March 2025. It made that permanent in August 2026 and says it will delete the data it already collected on US owners.

Elsewhere, the new registers are arriving closed. Switzerland's first federal register of company owners took effect this month, and it isn't public. Panama tightened its rules, but only authorities can see the data. Australia's rules kicked in this July with no public register. The EU's top court shut public access to ownership registries back in 2022.

If ownership tracing is part of your work, this is a useful map of where the doors are closing. I'd love to hear what workarounds people here are leaning on instead.

OCCRP and RFE/RL's Radio Ozodlik report that Otabek Umarov, the Uzbek president's son-in-law, got UAE citizenship in April 2023 while he was deputy head of the presidential security service. Uzbek military law bars a second citizenship in that post. The method is what I'd borrow. They started from leaked copies of his UAE passport and residence permit, which OCCRP says it independently authenticated. Then they used the Uzbek military service law to show why the passport matters.

For property, they went through leaked Dubai land registry data, recent service-charge bills and older Dubai real estate data. That turned up 13 apartments worth about $7 million. The purchase records show his brother Oybek bought them in 2021 and 2022, and Umarov became the listed owner in 2025. It's a good reminder to check who owned an asset before your subject did.

They also reported what came up empty. Public commercial registries show no private companies in his name while he held the post, and they say plainly they couldn't tell whether he bought the flats or was given them.

At sentencing in a 2021 road rage manslaughter case, Christopher Pelkey's sister played the judge an AI-generated video of her brother forgiving the man who shot him. She wrote the script herself. The judge said he "loved that video" and gave the maximum, 10.5 years.

Now an Arizona appeals court says the video crossed a line. Gabriel Horcasitas's conviction stands. But the court found the clip "so prejudiced Horcasitas as to render the sentencing procedure fundamentally unfair," so the judge has to look at the prison term again. The court built on a 2007 precedent about photographs and noted that the video doesn't show anything that actually happened.

If you ever get asked to explain or authenticate synthetic media for a legal process, this ruling shows where one court drew the line. Matthew Gault has the full story at 404 Media, including Stacey Wales's response.

When Fleet Farm settled Minnesota's straw-purchase lawsuit this year, it agreed to pay $1 million and make its internal records public. Those 694 documents now sit in a free firearms archive at UCSF's Industry Documents Library. ICIJ's Ben Dooley went through them. In 2021 an employee flagged a buyer who had bought six handguns in eight days, and the company kept selling to him. One of those guns was later used in a St. Paul bar shooting that killed one person and injured 14.

The useful part for the rest of us is that settlements can force document releases, and UCSF keeps similar searchable collections on tobacco, opioids, chemicals, drugs, fossil fuels and food. If you work on any of those industries, add it to the places you check before you file a records request.