Cyber investigations
Online Defamation and Smear Campaign Investigations: Find Who Is Behind It and Prove It
Fake reviews, false accusations and coordinated smear campaigns do real damage. We identify the people behind them, preserve the evidence, and support your attorney.
- Who we helpCompanies, executives, public figures, individuals and their attorneys
- What you getThe source identified where the evidence allows, and a defensible evidence report
- How we startFree, confidential consultation
- ExperienceWorking cybercrime cases since 2008
Can you find who is behind online defamation?
Often, yes. We trace anonymous posts, fake reviews and smear campaigns back to the people responsible, even when they hide behind a VPN, as long as there is a suspect. We state how confident each finding is, and we tell you plainly when the evidence cannot get to a name.
Speed matters. Many providers delete their logs within months, so the earlier we start, the more evidence we can preserve.
Case study
Proven on a very public case: BrewDog co-founder James Watt
James Watt was the target of an online smear campaign, and the person behind it hid behind VPN cloaking services. Rexxfield identified them anyway. Mr. Watt chose to go public with the case, and it was covered by the press.
What we do
From anonymous attack to court-ready evidence
Online attacks leave traces. We find them, connect them and document them in a way your attorney can use.
Identify anonymous posters
We trace accounts, posts and fake reviews to the people behind them, even behind a VPN when there is a suspect.
Smear campaign investigation
We map coordinated campaigns across platforms and find who is organizing them.
Evidence preservation
Forensic captures that keep the original content, dates and URLs intact before it is edited or deleted.
Legal process support
We ghostwrite subpoenas for your attorney to issue, so providers hand over the records you need.
Platform and takedown evidence
Documentation that supports platform reports and your attorney’s legal requests.
Reports and expert testimony
Plain-language reports and affidavits, and expert testimony when the case goes to court.
How it works
Preserve first. Then find the source.
- Preserve. We capture the content and its metadata before anything can change.
- Trace. We follow the accounts, links and technical traces to the people behind the campaign.
- Identify. Where the evidence allows, we name the person and state how confident we are.
- Support the next step. We work with your attorney on subpoenas, claims and testimony.
- Lawful methods only. We do not hack accounts or devices. Evidence gained that way would harm your case.
Who we work with
People and organizations under attack
Businesses
From small companies to large corporations facing fake reviews, false allegations or a coordinated smear campaign.
Executives and public figures
Founders, executives, celebrities and influencers targeted by false claims and anonymous attacks.
Attorneys and law firms
Investigative and forensic support for defamation, harassment and anonymous-defendant cases.
Individuals
Private people facing personal attacks, impersonation or harassment online.
Related: Executive and celebrity threats · Identify anonymous accounts · Litigation support
Common questions
Online defamation investigation FAQ
Can you identify an anonymous person who is posting defamatory content?
Often, yes. We trace posts, accounts and campaigns back to the people behind them using open-source research and technical analysis. We can identify anonymous attackers even when they hide behind a VPN, as long as there is a suspect. We state how confident each finding is, and we tell you plainly when the evidence cannot get to a name.
Can you remove defamatory content?
We prepare the evidence and documentation that platform reports and legal requests rely on. Removal decisions are made by platforms and courts, so we do not promise removal. Identifying the person behind the content is often what stops it.
What is the difference between defamation and harassment?
Defamation generally means false statements of fact that harm a person or business. Harassment is repeated, unwanted conduct aimed at someone. The legal definitions vary by location, and many cases involve both. Your attorney can tell you which claims apply. Rexxfield is not a law firm and this is not legal advice.
How quickly do I need to act?
As soon as you can. Many internet providers delete their IP address logs within about six months, and posts can be edited or deleted at any time. We preserve the evidence first, then investigate.
Do I need an attorney?
Not to speak with us. For legal action, yes. Rexxfield is not a law firm, so your attorney issues subpoenas and files claims. We can ghostwrite the subpoenas, prepare the evidence, write reports and affidavits, and provide expert testimony.
How much does an online defamation investigation cost?
Digital investigations start at a minimum of USD 5,000, and corporate investigations at a minimum of USD 10,000. We send a clear scope and fee after a free, confidential consultation.
Under attack online? Speak with an investigator.
The consultation is free and confidential.
Contact Our TeamLast updated: October 19, 2026. Rexxfield is a cyber-investigations firm, not a law firm. This page is general information, not legal advice.