Verify exact identifier matches
Find where an email, username, domain, or wallet appears and keep every match tied to its source.
Autonomous cyber investigations
Start with an identifier. Get the connected evidence.
Enter an email, username, domain, URL, or crypto wallet. DefenceCore discovers where it appears, follows connected public signals, and returns a sourced investigation with every match, relationship, and uncertainty ready for review.
Every result includes its supporting source and match reasoning.
Investigation seedWallet address
Results ready0x
0x1234…5678Ethereum · exact address match
Seed verifiedPublic handle@sample_operator
3 sourcesWeb propertyplaceholder.example
Cross-source matchOrganization recordPlaceholder Organization
Needs reviewPlatform
One identifier in. A connected investigation out.
Replace scattered lookup results with a structured map of exact matches, related signals, and supporting evidence.
Follow connected web signals
Pivot from the starting identifier to related handles, domains, accounts, infrastructure, and public mentions.
Build an evidence-led connection map
Separate verified links, possible connections, and unsupported assumptions in one reviewable investigation.
How it works
From a known identifier to reviewable evidence.
The agent runs the pivots. You see what connected, why it connected, and what remains uncertain.
- 01
Start with one digital identifier
Enter an email address, username, domain, URL, or crypto wallet already present in your case.
- 02
Let the investigation follow the evidence
DefenceCore checks exact appearances, discovers connected signals, and evaluates each potential link.
- 03
Review a sourced investigation
See the connection map, supporting sources, confidence, and unresolved questions in one workspace.
Use cases
Built for cyber investigations that start with a signal.
Investigate suspicious accounts, wallets, domains, and digital infrastructure from one evidence-led workspace.
Fraud signal triage
Expand a suspicious email, username, domain, or wallet before escalating a case.
Account and wallet investigations
Connect reused handles, public profiles, wallet records, and web mentions without assuming ownership.
Domain and infrastructure research
Trace public website, domain, and organization signals around suspicious infrastructure.
Open-source cyber research
Turn manual pivots across scattered tools into a structured, attributable evidence trail.
Evidence and trust
Designed to support judgment, not replace it.
DefenceCore keeps conclusions close to their supporting evidence and makes the limits of public-source research visible.
Evidence remains attached
Findings retain the public source and context used to support them.
Uncertainty remains visible
Possible matches, contradictions, and coverage limits remain explicit.
The investigator decides
A proposed connection can be reviewed, confirmed, or rejected by a human.
Pricing
Choose the investigation volume that fits your work.
Start free, then move to a plan when your investigation volume grows.
Free
$0
1 investigation, one time
- ✓Initial investigation results
- ✓Sourced findings and connection graph
- ✓No follow-up enrichments
- ✓No card required
Individual
$19/ month
10 investigations per month
- ✓Up to 10 follow-up enrichments per investigation
- ✓Saved investigation history
- ✓Sourced findings and connection graph
- ✓Report export
Pro
$49/ month
30 investigations per month
- ✓Up to 20 follow-up enrichments per investigation
- ✓Saved investigation history
- ✓Sourced findings and connection graph
- ✓Report export
- ✓Production-ready Pro data sources
For lawful, authorized fraud prevention, security, and investigative work.
Recent articles
Practical research for cyber investigators.
Guides to investigating emails, usernames, domains, wallets, and connected risk signals.
Best Crypto Wallet OSINT Tools for Investigators (2026)
A practical breakdown of the crypto wallet OSINT tools investigators use — block explorers, scam databases, sanctions APIs, blockchain analytics, and all-in-one identity platforms — plus how DefenceCore wallet screening fits.
Read article →How to Investigate Online Impersonation With OSINT
Learn how to compare suspicious profiles, emails, phone numbers, domains, and wallets to document online impersonation with sourced evidence.
Read article →How to Investigate Fraud and Abuse Signals With OSINT
A practical workflow for finding and evaluating attributable fraud, scam, spam, phishing, and abuse signals in public sources.
Read article →Questions
Frequently asked questions
A concise overview of how DefenceCore approaches public-source investigation.
What does DefenceCore investigate?
DefenceCore investigates digital identifiers: email addresses, usernames, domains, URLs, and crypto wallet addresses. It finds exact public appearances, follows connected signals, and organizes the results into one sourced investigation.
How does an autonomous cyber investigation work?
You enter one identifier already present in your case. The agent chooses relevant checks, follows useful findings into additional pivots, compares possible connections, and returns an evidence-led report. You do not have to manually search and combine results from multiple tools.
What identifiers can I start with?
Start with an email address, username, domain, URL, or supported crypto wallet address. A single identifier is enough to open an investigation.
What can DefenceCore find from an identifier?
Depending on the identifier and available evidence, DefenceCore can find exact web mentions, reused handles, related domains, public profiles, organization references, wallet intelligence records, and other connected identifiers. Coverage varies, and a missing result is not proof that no connection exists.
What's in a report?
A report includes the starting identifier, exact matches, a connection graph, risk or context signals, confidence assessments, unresolved questions, and the evidence supporting each finding.
Does a connection prove ownership or identity?
No. A shared handle, transaction, domain reference, or public mention can be an investigative lead without proving common ownership or real-world identity. DefenceCore keeps those distinctions visible and leaves confirmation to the investigator.
Who is DefenceCore for?
DefenceCore is built for cybersecurity, fraud operations, trust and safety, compliance, and open-source research teams conducting lawful, authorized investigations.
How is this different from a single lookup tool?
A lookup tool normally returns one result from one data source. DefenceCore follows the investigation across multiple relevant sources, evaluates connections, and presents the results with evidence and uncertainty in one workspace.
Is the AI making the final decision?
No. Automation plans research steps and organizes findings, but it does not turn weak evidence into a confirmed fact. Investigators review the sources, confidence, and contradictions before deciding how to use a result.
Start an investigation
Turn one digital identifier into a sourced investigation.
Start with an email, username, domain, or wallet. Review every connection and its evidence.