investigate-without-getting-madelisted

# Investigate without getting made Collection is bidirectional. Most investigators are burned not by a clever adversary but by a platform doing exactly what it advertises: telling the subject who looked at their profile, suggesting the investigator to the subject as someone they may know, or marking a story as viewed. The default failure is not a leaked IP address. It is being logged into a real account. ## Threat-model first OPSEC effort should be proportionate. Answer three questions before you spend a day building infrastructure — or before you decide you need none. 1. **Who might notice?** A dormant shell company, a moderately technical individual, a criminal group running monitored infrastructure, or a state service. Their capability sets the bar. 2. **What would they see?** Passive collection: a line in a server log. A logged-in visit: your name. An interaction: your persona and its history. 3. **What is the consequence?** Nothing, or evidence destroyed and accounts gone dark, or the investigation attributed to your organisation and disclosed, or physical risk to you or a source. | Situation | Proportionate posture | |---|---| | Registries, archives, CT logs, court records | Normal browser, no persona. You are one of thousands. | | Viewing a target's public website | Clean browser profile, commercial VPN, no logged-in sessions. | | Any logged-in platform view of a target | Persona account, dedicated profile, and check the platform's viewer-notificati