The Ghost in the Machine: How We Uncovered the Network Behind a Global Viral Campaign

It started subtly, then it was everywhere. From the metro stations in Amsterdam to the streets of Brisbane and the heart of Sydney, vibrant digital billboards lit up with a surprising message: birthday greetings for Indian Prime Minister Narendra Modi’s 75th. It was a slick, international campaign that immediately sparked a question across the internet. On Reddit threads and X posts, everyone was asking the same thing: who is behind this?

The only clue was a single line at the bottom of each ad: “Paid for by ExHproductions.com.”

As investigators at Justice for Prosperity, our curiosity was piqued. We, like everyone else, visited the website. It was professional and vague, promising “highly exclusive, private and unforgettable experiences” from a base in Dubai since 2020. But it was a digital ghost. There were no names, no specific case studies, no verifiable details—just a wall of corporate secrecy. ExH Productions was clearly designed to be anonymous. For anyone trying to figure out who was funding this global campaign, the trail went cold before it even began.

Hitting the Wall, Then Finding a Door

The public investigation stalled. Speculation was rampant, but concrete leads were nonexistent. This is a common challenge in the world of Open-Source Intelligence (OSINT), finding the first thread to pull when a subject has intentionally erased their tracks.

This is precisely where we turned to Maltego Search.

While manual searching had yielded nothing, we knew the digital world always leaves footprints. OSINT isn’t magic; it’s the art of finding and connecting publicly available data points that, on their own, seem meaningless. Maltego is the engine that makes those connections visible.

Our investigation began with almost nothing—just a single email address associated with the ExH Productions domain. We plugged that one piece of data into Maltego Search, and suddenly, we had our first break.

  • The platform immediately linked the email to a Google account.
  • That Google account, in turn, was tied to a public Google review for a London-based company. The review was authored by a man named Justin Hammond.
  • With a name and a potential location, we pivoted to LinkedIn. There, we found a Justin Hammond whose professional profile placed him squarely in the events sector—the very industry ExH Productions claimed to operate in.
  • From his profile, Maltego helped us map his professional network, quickly establishing a connection to another company, Forta Productions.

In a matter of minutes, Maltego had taken us from a deliberately anonymous website to a named individual and his wider business network.

From Anonymity to a Network Map

What seemed like a shadowy, impenetrable organization was, with the right tools, entirely traceable. The carefully constructed anonymity of ExH Productions fell apart when its digital threads were pulled. The very tool they used to register their digital assets, a simple email address, became the key to unlocking their identity.

This case was a perfect reminder that in our hyper-connected world, true anonymity is an illusion. For organizations like ours, committed to transparency and accountability, that’s a powerful truth. While the internet was buzzing with theories, Maltego Search allowed us to cut through the noise and deliver a fact-based answer, demonstrating the undeniable power of connecting the dots.

Table of Contents

Read more articles

duitse-desinfo-website

Russische desinformatie bereikt Nederlandstalig miljoenenpubliek via nieuwe route

In aanloop naar de Nederlandse gemeenteraadsverkiezingen bereikte Russische desinformatie het Nederlandse taalgebied via een nieuwe route. Onderzoeksplatform Stichting Justice for Prosperity bracht in kaart hoe een vervalst nieuwsverhaal eerst werd gelanceerd rond de Duitse deelstaatverkiezingen en een dag later werd verspreid onder een Nederlandstalig publiek. Dat leverde in korte tijd

JfP_Vlag_website

Grote groei rechtsextremistische Defend-groepen

Maatschappelijke manipulatie en intimidatie gebeuren niet alleen online en met desinformatie, ook offline wordt er steeds meer druk uitgeoefend. Extreemrechtse Defend-groeperingen ondermijnen de democratie. Zij reizen door heel Nederland om besluitvorming te beïnvloeden van lokale gemeenten rondom AZC’s.
website

Honderden illegale politieke advertenties

Over minder dan een week gaan we in Nederland weer naar de stembus voor de gemeenteraadsverkiezingen van 2026. Lokale democratie, dicht bij huis. Jouw buurt, jouw gemeente, jouw stem. Maar wat als politieke advertenties die jij op Facebook of Instagram ziet helemaal niet legaal op jouw tijdlijn mogen verschijnen?