We investigate coordinated online activity, trace digital infrastructure, and assess technical exposure to help government and national security teams answer complex questions.
Argelius Labs is an independent investigations and research firm led by Matt Edmondson. We combine open-source intelligence, digital forensics experience, and technical analysis to examine online activity and the infrastructure behind it.
Our work focuses on defined questions: how accounts and websites are connected, whether activity shows signs of coordination, what the available evidence supports, and where further investigation is needed. We also provide technical exposure assessments for acquisition and investment teams.
Each engagement is scoped around the question, the available sources, and the decision the findings need to inform.
Engagements are led by Matt Edmondson, drawing on two decades of investigations and experience applying OSINT and digital forensics to national security and law enforcement questions.
We agree on the question, scope, and intended use of the findings before research begins. This keeps the work focused and makes the limits of the assessment clear.
We connect online activity with the domains, websites, services, and other technical evidence that can help explain it.
Reports distinguish observed facts from analytical judgments, document sources, and explain confidence and remaining gaps.
Findings are presented for the people who need to use them, with a clear summary, supporting evidence, and priorities for follow-up.
Our services are designed for government and national security teams, the organizations supporting them, and security teams with complex investigative questions. We also provide technical exposure assessments for acquisition and investment teams.
Examples include whether online accounts or websites are connected, how a network distributes and amplifies content, what digital infrastructure supports observed activity, and which findings need further corroboration. We scope each engagement around a specific question.
We define the research question, sources, deliverables, and timeframe before proposing a fee. Work can be structured as a defined project or, where appropriate, recurring research support with an agreed reporting cadence.
Depending on the engagement, deliverables can include a findings report, source register, timeline, relationship map, technical asset inventory, and a briefing. Reporting explains what was observed, how conclusions were reached, and what remains uncertain.
We investigate connections among accounts, entities, and infrastructure and assess competing explanations. Attribution depends on the evidence available. Reports distinguish documented links from judgments about control, intent, or sponsorship.
Our initial focus is the target’s technical footprint and observable exposure. Deeper technical validation depends on scope, access, and authorization. The assessment supports the transaction’s wider diligence process and identifies questions that need further investigation.
Use the contact form or business email to provide a general description and your preferred way to connect. We will discuss an appropriate channel before you share sensitive project information.
I finally got this one cleaned up enough to share. It’s a bilingual field guide to doing OSINT on the Chinese-language internet, up on GitHub now. Here’s the link: https://github.com/ArgeliusLabs/chinese_osint_search_dorks Most Western
A few days ago, a fascinating article started making the rounds on X (Twitter) by security researcher @Harrris0n. The premise was simple but striking: Waze’s public live map exposes enough data to
Yesterday I walked through mapping a Synology share and pointing qgrep at breach data so the index lives next to the dataset instead of cluttering my home directory. That’s great for portability,