One bad account is rarely just one bad account. Pull the thread and a single bad actor can unravel an entire criminal network interwoven throughout your platform and across the internet. Here's how investigation teams track the signals, differentiate between different kinds of networks, and turn scattered clues into enforcement that sticks.
Read the blog post, then download our network case study to see LegitScript's investigative team in action.
September 1, 2026 | by LegitScript Folks
Imagine a post or a listing pops up on your platform marketing a banned product. Maybe it’s an unapproved peptide, a weapons part, or a banned cosmetic. It’s a single account with just a handful of followers; nothing that looks overly worrisome. An analyst could take down the account and move on.
But that account links to a website with a registered business address. That address shares a phone number with another website. That site redirects to a domain hosted on the same IP as forty others also offering illicit products. Pull that thread far enough and what started as an isolated violation turns into a criminal network spanning continents.
This is the real shape of online crime today. It doesn’t live in one account, one listing, or one platform. It lives across a web of infrastructure, behavior, and money that only becomes visible once you start connecting the pieces.
See Incidents as Symptoms of a Larger Problem
The instinct to treat bad content as an isolated incident is understandable. Most detection systems are built to catch individual violations: a listing, a post, an account. But sophisticated bad actors know this, and they build around it.
When one account gets taken down, another pre-prepared account goes up in its place, often within hours. When a platform bans a keyword, the operation shifts to a new one. When enforcement gets close to the source, the storefront moves, the domain redirects, or communication drops into an encrypted app.
Treating each of these as a separate event means playing an endless game of whack-a-mole. Treating them as expressions of a single underlying network is what actually disrupts the operation.
Case Study: See how we mapped an international fake ID network. Download now.
Understand That Everything Is Connected
Criminal activity online rarely stays in one lane. A single actor might touch payment processors, merchant websites, product listings, social media, business registrations, and customer communication all at once. None of these exist in a vacuum.
That’s why effective network detection starts with a simple premise: Nothing online is truly standalone. A phone number connects to a business registration. A business registration connects to a website. A website connects to a payment processor. Consumers, regulators, and brand reputation all sit inside the same web.
Investigators who understand this don’t just ask, “Is this content violative?” They ask, “What is this connected to?”
Learn How Networks Are Connected
Not all networks look alike, and the signals that expose them fall into two broad categories.
Technical Networks
Technical networks share back-end infrastructure. Accounts registered through the same device. Serialized email addresses following an identical naming pattern. Domains hosted on the same IP address, especially when several IPs are pinged in a short window. On-platform patterns like coordinated follower behavior or commenting activity.
Socio-behavioral Networks
Socio-behavioral networks share front-end characteristics instead. Similar branding across profiles. Duplicated content or near-identical narratives. Shared ideology or messaging. These accounts might have no technical connection at all, and yet they’re clearly operating as a single entity, often taking direction from the same outside source, like a private channel that distributes ready-made scripts, images, and hashtags to a whole roster of accounts.
Neither signal type is sufficient on its own. An IP address alone is weak evidence, since thousands of unrelated sites can share a single IP. But an IP address combined with a shared registrant, a matching redirect pattern, and duplicated marketing language stops being a coincidence and starts being a case.
Know the Signals Analysts Actually Chase
Building out a network starts with a small set of seed accounts or listings already known to be violative, then asking what else connects to them. In practice, that means tracking:
- Domain registration details: when a domain was registered, by whom, and whether ownership has changed
- Shared or rotating IP addresses, evaluated over a tight time window rather than in isolation
- Reused contact information: phone numbers, email addresses, and registrant data that show up across supposedly unrelated sites
- Redirect chains that connect a low-risk surface presence to a higher-risk operational core
- Business registration records, including cases where a company is legally registered as one type of business (a leather goods manufacturer, for instance) while actually operating a completely different kind of storefront
- Payment methods, which often shift toward cryptocurrency or bank transfer as an operation gets more cautious
None of these signals prove much by themselves. The proof is in the pattern. Every signal can have an innocent explanation on its own. It’s the pattern across all of them that makes a case.
Use AI Where It Helps, and Not Where It Doesn’t
Automation is genuinely useful for pulling data at scale: pulling thousands of posts, listings, and accounts, and scanning them for shared language or emerging trends. It’s far faster than a human at finding a pattern across a huge dataset.
What it’s not good at is judgment. Bad actors constantly adjust their language to stay ahead of detection, swapping one code word for another as soon as the first one gets flagged. Spotting that shift, understanding intent behind an image that looks innocuous out of context, and deciding whether a pattern is coincidence or coordination still requires a person who understands what they’re looking at.
This is why the most effective approach pairs automation with human review rather than choosing one over the other. Automation surfaces the volume. Humans supply the context and the judgment calls that make enforcement defensible.
Turning an Investigation Into Enforcement
Finding a network is only half the job. Turning that intelligence into lasting enforcement means going beyond taking down the accounts you’ve already found.
A few practices separate a strong response from a temporary fix:
Block the infrastructure, not just the accounts. Once a piece of technical infrastructure, an IP address, a device, a redirect link, is confirmed as violative, any new account that touches that same infrastructure can be flagged automatically. This makes it much harder for an operator to simply spin up a replacement account.
Feed what you learn back into detection. Confirmed keywords, imagery, and usernames should get folded into ongoing monitoring and model training, so the next version of the same network is caught faster.
Build a defensible case with evidence from outside the platform. What looks ambiguous inside one platform’s data often looks obvious once it’s connected to activity happening elsewhere. Off-platform evidence, a linked storefront, a matching business registration, a shared payment processor, turns a borderline judgment call into a clear one.
Measure what enforcement actually prevented. Impressions and views stopped before they happened. Payouts avoided through fraudulent rewards or affiliate programs. Accounts caught before they gain any followers at all. These numbers make the case for continued investment in network-level enforcement, because taking down accounts doesn’t always look like a win on a platform’s raw engagement metrics.
The bad actors behind these operations are persistent, well-resourced, and quick to adapt. But every pivot they make to evade detection also produces new data. A new device. A new domain. A new redirect. Followed consistently, these breadcrumbs lead to the same conclusion: the account in front of you is rarely the whole story.
Learn From a Real Case Study
See network investigation in action. We recently mapped a fake ID network that started with two accounts and grew into over 90 connected websites, spanning operations in China and the United States, hidden behind a legitimate-looking leather goods manufacturing business. Download the full case study to see exactly how the investigation unfolded, signal by signal.
Inside the Fake ID Network
Learn how LegitScript identified a transnational network, tracked its activity across platforms, and developed valuable intelligence to help clients quickly spot and remove these bad actors.
