Cyber Investigations
Identify Anonymous Accounts: Find the Person Behind the Profile
Fake profiles, anonymous harassers, threatening emails and texts. We identify the real people behind them using open-source research, technical analysis and controlled engagement, and we document the evidence for court or the police.
- Who we helpIndividuals, businesses and attorneys
- What we investigateSocial media, email, phone, websites and reviews
- What you getA report naming the person, or an honest assessment of the limits
- Hiding behind a VPN?With a suspect, we can still identify trolls using VPNs, proxies or Tor
- How we startFree, confidential consultation
Can the person behind an anonymous account be identified?
Often, yes. We start with open-source research, which can identify the person on its own. When it cannot, we add technical analysis, including IP address and device data, and controlled engagement with the account holder. We cannot promise a name in every case, and we will tell you plainly when public data runs out. See how an OSINT investigation works.
Even behind a VPN: using a VPN, proxy or Tor does not make someone untraceable. When you have a suspect, we can identify trolls even when they hide behind one.
Save the evidence before the account disappears, and contact us early.
What we investigate
Anonymous activity we trace
The methods work on any platform. These are the cases we see most often.
Fake and anonymous social profiles
Accounts used to harass, impersonate or spread false claims on Instagram, X, TikTok, Facebook, Snapchat, Reddit and more.
Trace a fake Instagram account →Harassment and cyberstalking
Repeated, anonymous contact meant to intimidate. We identify who is behind it and document it for legal action.
Defamation and harassment →Impersonation and fake profiles
Someone pretends to be you, your company or your executive. We identify the operator and preserve the evidence.
Anonymous email and websites
Threatening emails, fake review sites and defamatory pages hosted behind privacy services.
Can ProtonMail be traced? →Threatening texts and calls
Messages from VoIP, burner and spoofed numbers, including TextNow and similar apps.
Can you trace a TextNow number? →Extortion and blackmail
Anonymous threats to expose, leak or smear. We work quickly to identify the sender and support your next steps.
Platforms we investigate
InstagramX (Twitter)TikTokFacebookSnapchatWhatsAppYouTubeRedditEmail and websitesAll other platformsHow we identify them
Four methods, used in order
1. Open-source research
We map the account’s footprint: reused usernames, linked accounts, photos, writing habits, posting times, domain records and public records. This often identifies the person by itself.
2. Technical analysis
We examine IP addresses, device details, email headers, hosting and domain data where we can capture or obtain them.
3. Controlled engagement
When public data is not enough, our investigators engage the account holder under carefully planned conditions to draw out identifying information.
4. Evidence you can use
We document everything with chain of custody and rule suspects in or out. We find the evidence that helps build your case, work with your attorney, and can ghostwrite subpoenas if needed. We have prepared hundreds of subpoenas, so we know what to ask for and how.
IP addresses
What an IP address can and cannot tell you
An IP address is one clue, not an answer. VPNs, proxies and Tor make IP-based tracing harder, but they do not make someone untraceable. When you have a suspect, we can identify trolls even when they hide behind a VPN, proxy or Tor. We start with open-source research and use IP data as one input among several.
- It can show the internet provider, country, region and approximate city.
- It does not give a street address, a name or a phone number.
- Mobile IP addresses are less precise than home connections.
- With a suspect, we can identify trolls even when they use a VPN, proxy or Tor.
- Device details such as browser, language and hardware settings can help link activity to a person.
- If you already have a suspect, matching or mismatching data can rule them in or out.
Real cases
Identification in practice
Anonymous texts for over a year
A client was harassed by anonymous messages and needed proof to go to court. We traced the number back to a person.
Read the case study →Extortionist identified in 36 hours
A fake website was set up to hijack search results for a US business. We identified the person behind it and had the defaming material removed.
Read the case study →Two women falsely accused
Our investigation showed the accusers had fabricated threatening texts to frame our clients.
Read the case study →Questions
Identifying anonymous accounts FAQ
Can you find out who is behind an anonymous account?
Often, yes. We start with open-source research, then add technical analysis and controlled engagement when needed. Some cases cannot be solved with public data alone, and we will tell you plainly if yours is one of them.
Can you find someone by their IP address?
An IP address usually shows the internet provider and an approximate location, not a name or street address. It becomes useful when combined with other evidence, which is why we treat it as one clue among several.
Does a VPN stop you from identifying someone?
A VPN makes IP-based tracing harder, but it does not make a person untraceable, and when you have a suspect, we can identify trolls even when they use VPNs, proxies or Tor. People still leave traces in their usernames, writing, linked accounts, domains and behavior, and those are where we start.
What should I save before the account disappears?
Take screenshots with the date and URL visible, save the profile link and username, keep the original emails and messages with full headers, and do not delete anything or confront the person. Then contact us as early as you can.
Do you work with attorneys, and is the evidence usable in court?
Yes. We document our work with chain of custody and work with attorneys throughout. We are not a law firm, but we provide litigation support if a case goes to court, and we have prepared hundreds of subpoenas for attorneys and clients.
Who investigates your case
Rexxfield’s team includes Stephen Dougherty, a former U.S. Secret Service investigator with more than 15 years in cybercrime and wire fraud; Ronnie Tokazowski, our CTO and a threat-intelligence researcher with more than 15 years of experience; and Anna Hulst, a licensed private investigator with more than 10 years of experience specializing in OSINT and social engineering. Meet the full team.
Related: OSINT investigation · Online defamation and harassment · Litigation support · Case studies
Need to know who is behind an account?
Speak with an investigator. The consultation is free and confidential.
Contact Our TeamLast updated: October 15, 2026. Rexxfield is a cyber-investigations firm, not a law firm. This page is general information, not legal advice. Results are never guaranteed.