How to unmask someone behind anonymous online posts

By Yair Cohen, Solicitor specialising in internet law

When someone is attacking you anonymously online, the first question is almost always the same: who is behind this? Until you know, the rest of the decision tree stays locked. You cannot serve a defamation claim on a Twitter handle. You cannot apply for an injunction against a Reddit username. You cannot send a meaningful cease and desist letter to "@user_72341". The legal route forward, whatever it eventually is, opens up only once the person on the other end of the screen has a name and an address.

That identification work is what this firm does. It sits at the front of nearly every internet law matter we take on, whether the eventual claim is defamation, harassment, blackmail, intellectual property infringement, or the kind of impersonation case in which the harm is sustained simply by the impersonator continuing to exist. Identification is the apex of the work. Everything else is downstream.

The hardest part is rarely the law. It is finding the person.

Two kinds of work, used together, get us there. Open-source intelligence, or OSINT for short, is the continuous lower-friction strand. It is a structured search of publicly available material, run by trained investigators using lawful methods, that pieces together a real-world identity from the digital traces an anonymous account has left across the open internet. Court orders are the interventional strand. They are formal applications that compel a platform or a registrar to hand over the information they hold. Most cases use both. OSINT runs first, runs in parallel, and very often resolves the question before any court order is needed.

Identification is the apex of internet law work

The order in which clients tend to think about this work is the opposite of how it actually runs. Many readers come to the firm expecting to ask for a court order against a platform. They have read about Norwich Pharmacal orders. They have heard that you can compel Google or Meta to release the name behind an account. They are surprised when our first response is to look at the open internet rather than the court list.

The reason is straightforward. In most cases, OSINT produces a faster, cheaper and quieter answer than a court application. The court route remains important, and there are cases where it is the only route. The working sequence is OSINT first, court order if the open work runs its course without producing a name, and OSINT again to convert whatever the court order returns into something that can actually be used.

Court disclosure rarely arrives as a clean name and address. The platform may hold only an email account and an IP address. The IP resolves to a coffee shop or a VPN. The email is a throwaway. The registered name, where there is one, may be false. What the court order delivers, in many cases, is a set of clues that still need running down. OSINT is the technique that takes those clues and produces a real person at a real address.

Open-source intelligence: how we identify anonymous internet users

OSINT is the practice of gathering and analysing information that is already publicly available, then piecing it together to answer a specific question. In our work, the question is usually the same: who is the person behind this account?

The "open" in open-source does not mean unregulated. It means that the underlying material is accessible to anyone who knows where to look and how to analyse it. OSINT does not involve hacking, deception, or any unlawful access to private accounts. It uses social media profiles, public registers, archived web pages, image search results, leaked username databases, and the small digital traces nearly everyone leaves online over time.

A Google search is the most basic form of open-source research. If a Google search is a tourist standing in Baker Street and looking around, OSINT is Sherlock Holmes. The information available to each is the same. The difference is what they notice, how they connect it, and what they can prove from it.

The work itself sits somewhere between investigation and analysis. Trained investigators run the searches. The findings are cross-referenced against regulated databases that lawyers and licensed investigators may use for legitimate purposes such as tracing debtors, serving proceedings, and identifying defendants in civil claims. Every page captured is preserved with a timestamp and a digital hash, so that the evidence can later be relied on in court. A properly conducted OSINT investigation does not produce a guess. It produces a chain of evidence in which each link is independently verifiable.

We do this work in house. The investigators and developers who run it sit inside the firm rather than at an external supplier. That continuity matters. The same team that identifies the person behind an account also drafts the letter, files the claim and runs the matter through to its conclusion. There is no handover between a discovery boutique and a substantive firm, and no loss of evidentiary thread in the gap between the two.

How OSINT identified the person behind a four-year impersonation campaign

In 2026, the firm took on a case that has had substantial public coverage. Sasha-Jay Davies is a young artist from South Wales who, for close to four years, had been impersonated across Instagram, TikTok and dating platforms under the name "Sophie Kadare". The impersonator used her photographs, including AI-edited versions of them, to build relationships with men online. More than twenty men had at some point believed they were in contact with her. Some had approached her in the street.

Sasha had reported the accounts to the platforms many times. Some came down. New ones replaced them. South Wales Police were investigating. The criminal route was slow. The platform route was failing to keep pace with the impersonator's ability to spin up new accounts as fast as the old ones came down.

Sasha appeared on ITV's This Morning in early 2026 to talk publicly about what was happening to her. Our founder Yair Cohen was invited onto the same segment to comment on the legal side. After the broadcast, Yair offered to take the matter on. Within less than 48 hours of being instructed, the firm had identified the person behind the Sophie Kadare network.

The investigation started from a single Linktree page Sasha had gathered herself. Two of the outbound links on the Linktree pointed to the Sophie Kadare profiles she already knew about. The third pointed to a SoundCloud account in a different name. That third link was the lead. A cross-platform username search through specialist OSINT software returned a separate route to the same SoundCloud profile, independently verifying the link. From there, a cross-reference against regulated investigative databases produced a name, a date of birth, an address in South Wales and a verified family connection.

A Part 7 claim was issued in the High Court within weeks, naming the identified individual as the defendant. The proceedings are continuing and the firm will not comment on them in detail while they are live. What can be said is that the move from a faceless username to an identified person in under 48 hours, against a campaign that had run for nearly four years, was the unlock the case had been waiting for.

A fuller account of the investigation, and the legal options that opened up once the impersonator was identified, will follow as a standalone case study on this site.

When a court order is the right next step

There are matters in which OSINT, however carefully run, does not produce a confident identification. The trail goes cold. The account is too thin. The person behind it has used burner emails, fresh devices, a VPN and no reused images or usernames. In those cases the open-source work narrows the field rather than closing it, and a court application becomes the right next step.

The most common UK route is a Norwich Pharmacal order. The jurisdiction comes from the 1974 House of Lords decision in Norwich Pharmacal Co. v Customs and Excise Commissioners [1974] AC 133. The order requires a third party, usually the platform hosting the content, to disclose information that would identify a wrongdoer. The court will grant the order where it is satisfied that an actionable wrong has been committed, that the third party has become innocently mixed up in that wrong, and that the disclosure sought is necessary, proportionate and the only realistic way to obtain the information.

Where the platform cooperates, much of the work happens before any contested hearing is needed. Google and Meta, in particular, have legal teams that can be engaged on agreed terms. We have obtained meaningful disclosure from both on that basis, often in a matter of weeks rather than months, and frequently without anyone attending court at all. Our experience with the Google route is set out separately in get disclosure from Google. The cost is materially lower than a contested application because the court time is shorter and counsel's involvement is more limited.

Where the platform pushes back, the application becomes contested. The cost rises. The timetable lengthens. The court still tends to grant the order in clear cases, but the lighter-touch route is no longer available.

Domain registrant unmasking is a related route. When the harmful content sits on a website rather than a social media platform, the underlying registrant of the domain is often the realistic target. ICANN's registration data access process, registrar-level disclosure and, where needed, a court order against the registrar can put a name and an address behind the domain. We use this route for impersonation websites, fake review sites, and the kind of revenge-publication site that goes up specifically to damage one named individual.

When the trail crosses into the United States

A meaningful share of identification work involves a US route. The platforms hosting the conduct are often US-incorporated. The registrars and the hosting providers frequently sit in California, Arizona or Florida. The conduct is happening to a UK person on UK-facing platforms, but the disclosure mechanics may need to operate in a US court.

There are three routes we use regularly. A US state court John Doe action allows the firm to start proceedings against an unknown defendant and to seek early discovery from the platforms and the registrars in the same jurisdiction. Domestication of a UK order in a US state court takes a UK judgment, often a Norwich Pharmacal order, and asks the US court to give it effect locally. A 28 U.S.C. § 1782(a) application is a federal court route that allows discovery in a US court in aid of foreign proceedings, including proceedings that have not yet been issued in the UK.

Each route has its own cost profile, its own timetable and its own evidentiary requirements. We choose between them on the facts, not by reflex. The starting fees for the US routes are set out below, alongside the UK figures, and the underlying procedure is covered in fuller depth in our guide on disclosure from USA websites and companies.

Identifying a serial harasser through cross-border disclosure in Arizona

The firm represented the Phipps family of Origin Design in long-running proceedings against Paul Britton, an individual who had run a sustained campaign against the family and the business. The case is a clear example of how the firm's identification work crosses borders when the target sits behind US-incorporated infrastructure.

The harasser had used fake email accounts, registered domains under false names, and operated through US-incorporated platforms. The disclosure route ran through the US federal court in Arizona, where the firm obtained subpoenas against GoDaddy and PayPal. Working from the records produced, supported by audio evidence obtained through investigative work, the firm built a pattern of conduct that the court eventually accepted. The criminal conviction came first. The civil damages followed. The full account is set out in our standalone case study on the case of Paul Britton and Origin Design.

Emergency identification

Some cases will not wait. A threat to life. A child at risk. A credible threat of imminent violence. An active blackmail in which payment is being demanded against a short deadline. In these matters the identification work has to compress into hours rather than weeks.

We have a working pattern for emergency matters. Out-of-hours OSINT runs first. Where the platform has a 24/7 emergency disclosure channel for life-or-limb cases, we engage it directly with the relevant evidence package. Where a court application is needed, we can prepare an urgent without-notice application within the same day. The aim is to convert the threat into an identified person fast enough for the police, or for the court, to act before the harm happens.

This work is run at cost. The starting figure given below reflects the fact that emergency matters tend to absorb senior time at short notice across the whole team.

What identification work costs

The firm publishes starting fees for the main identification routes. The figures are floors, not fixed prices. The actual cost on a given matter turns on the target's digital footprint, the platforms involved, whether those platforms cooperate, whether a contested hearing is needed, and how many jurisdictions are in play.

Why floors rather than fixed prices. Identification work scales with the facts. A targeted OSINT check against a thin online footprint may resolve within half a day at the lower end. A multi-week investigation involving offline elements, cross-platform correlation and US disclosure can sit considerably higher up the range. The starting figures show the entry point for each route. The full estimate for any given matter comes after a fixed-fee consultation, in which we look at what the trail actually shows and tell you which routes are realistic for the work in front of us.

Identification is the start, not the end

Once we know who is behind the conduct, the matter opens up. The choices that were impossible while the publisher was anonymous become available. A defamation claim against a named defendant unlocks remedies the law does not provide against an avatar. A harassment injunction can be served on the person responsible. A blackmail file can be passed to the police with a name attached. A cease and desist letter, sent to a real home address in a real name, often ends the conduct without any further step.

The substantive routes are covered in their own places on the site. Where the next step is a defamation claim, see our guide on defamation legal advice. For harassment, see online harassment legal advice. For blackmail, see internet blackmail and extortion. For platform-side removal of the content itself, see our guides on the defamation removal letter and the defamation cease and desist.

Most matters do not run linearly through that list. They run in parallel. The cease and desist may go out the same week as the disclosure application. The harassment injunction may be drafted while OSINT is still running. The firm runs the identification work and the substantive matter together, on the same file, with the same team. That continuity is part of why clients come to us for this work.

Frequently asked questions

Is OSINT legal?

Yes. OSINT relies on lawful access to publicly available information, supplemented where appropriate by regulated investigative databases that lawyers and licensed investigators may use for legitimate purposes. It does not involve hacking, deception, or any unlawful access to private accounts. The discipline around how the evidence is captured matters: pages are preserved with timestamps and digital hashes so that the chain of evidence stands up in court later.

How long does identification usually take?

In a meaningful proportion of matters, OSINT produces a confident identification within a few working days. Where the trail is harder, or where a court order is needed, the timetable extends to weeks. Emergency matters compress into hours. The realistic answer at the start of a matter is that we will know whether OSINT can resolve it within the first stage of work, and that the route from there depends on what the trail shows.

What if all I have is a username?

That is often enough to start. A single username, used across more than one platform, frequently anchors the entire investigation. The reuse of usernames, profile photographs and writing patterns across accounts is what allows the open-source work to connect what looks like several independent identities back to one person.

Can you identify someone outside the UK?

In many cases, yes. OSINT does not respect borders. The court disclosure routes do, which is why a meaningful share of the work crosses into the US. Where the conduct involves a US registrar, a US platform or a US-based perpetrator, we use the disclosure routes set out above. Where the trail leads further afield, the route is fact-specific and we will say what is realistic at the consultation stage.

Will the platform tell the person we are asking?

Sometimes. Some platforms notify the account holder when a disclosure request is made. Others do not. Where notification would defeat the purpose of the application, the court can be asked to seal the order or to delay notification. Whether that step is appropriate depends on the facts, and we will advise on it before the application goes in.

What if the OSINT trail goes cold?

The court route remains available. A Norwich Pharmacal order against the platform, or a US 1782 application, will still produce whatever the platform actually holds. Where the platform holds nothing useful, the matter may need to be reframed: a takedown route, a strategic pause to wait for further conduct that produces more evidence, or, in narrow circumstances, a substantive claim against a different party. We will tell you when the realistic options have run out, rather than continue billing without a plausible route to identification.

Do you offer a fixed-fee consultation?

Yes. The consultation lets us look at what the trail actually shows, tell you which identification routes are realistic, and give you a costed plan for the work. We do not start identification work without a clear scope and a clear costs estimate agreed with you in writing.