Open sources hold a great deal about people and organisations: company registers, domain records, court filings, social profiles, leaked datasets, archived pages. The information is public. Connecting it correctly is the work.
Durandir Intelligence is the tool we built to do that connecting. Starting from a name, an email address, a domain or a company, it collects what open sources say and links the results into one picture of who is who and how they relate.
It is used for two kinds of work that turn out to need the same method: threat research and commercial due diligence.
Attribution you can defend
The easiest mistake in open-source work is to merge two people who share a name, or to trust a link because it looks plausible. Durandir Intelligence treats every connection as a claim that needs support.
Each link records what it is based on. A match between a profile and a person may rest on a shared email address, a reused username or a photograph, and those are not equally strong. It shows the basis and keeps weak matches separate from confirmed ones.
When two sources disagree, both are kept. You see the conflict and decide, with the evidence in front of you.
Threat research
Security teams use it to understand who is behind an attack or a campaign: which domains and servers belong together, who registered them, where the same operator has appeared before.
Findings are kept with their captures, so an indicator shared with another team arrives with the reason it is believed.
Due diligence
Compliance and investment teams use it to check a counterparty before a deal: who owns and controls a company, which other companies its directors run, whether it appears in litigation or adverse press.
The result is a report where each statement about a person or a company leads to the record it came from.
Investigating people carries legal duties. Durandir Intelligence is intended for work with a lawful basis, and data protection law applies to what you collect with it.