The Ghost in the Machine: How We Uncovered the Network Behind a Global Viral Campaign

It started subtly, then it was everywhere. From the metro stations in Amsterdam to the streets of Brisbane and the heart of Sydney, vibrant digital billboards lit up with a surprising message: birthday greetings for Indian Prime Minister Narendra Modi’s 75th. It was a slick, international campaign that immediately sparked a question across the internet. On Reddit threads and X posts, everyone was asking the same thing: who is behind this?

The only clue was a single line at the bottom of each ad: “Paid for by ExHproductions.com.”

As investigators at Justice for Prosperity, our curiosity was piqued. We, like everyone else, visited the website. It was professional and vague, promising “highly exclusive, private and unforgettable experiences” from a base in Dubai since 2020. But it was a digital ghost. There were no names, no specific case studies, no verifiable details—just a wall of corporate secrecy. ExH Productions was clearly designed to be anonymous. For anyone trying to figure out who was funding this global campaign, the trail went cold before it even began.

Hitting the Wall, Then Finding a Door

The public investigation stalled. Speculation was rampant, but concrete leads were nonexistent. This is a common challenge in the world of Open-Source Intelligence (OSINT), finding the first thread to pull when a subject has intentionally erased their tracks.

This is precisely where we turned to Maltego Search.

While manual searching had yielded nothing, we knew the digital world always leaves footprints. OSINT isn’t magic; it’s the art of finding and connecting publicly available data points that, on their own, seem meaningless. Maltego is the engine that makes those connections visible.

Our investigation began with almost nothing—just a single email address associated with the ExH Productions domain. We plugged that one piece of data into Maltego Search, and suddenly, we had our first break.

  • The platform immediately linked the email to a Google account.
  • That Google account, in turn, was tied to a public Google review for a London-based company. The review was authored by a man named Justin Hammond.
  • With a name and a potential location, we pivoted to LinkedIn. There, we found a Justin Hammond whose professional profile placed him squarely in the events sector—the very industry ExH Productions claimed to operate in.
  • From his profile, Maltego helped us map his professional network, quickly establishing a connection to another company, Forta Productions.

In a matter of minutes, Maltego had taken us from a deliberately anonymous website to a named individual and his wider business network.

From Anonymity to a Network Map

What seemed like a shadowy, impenetrable organization was, with the right tools, entirely traceable. The carefully constructed anonymity of ExH Productions fell apart when its digital threads were pulled. The very tool they used to register their digital assets, a simple email address, became the key to unlocking their identity.

This case was a perfect reminder that in our hyper-connected world, true anonymity is an illusion. For organizations like ours, committed to transparency and accountability, that’s a powerful truth. While the internet was buzzing with theories, Maltego Search allowed us to cut through the noise and deliver a fact-based answer, demonstrating the undeniable power of connecting the dots.

Table of Contents

Read more articles

elections

Beïnvloeding van verkiezingen Nederland

JfP is trots om te vermelden dat ons volledige rapport over de verkiezingen online staat. Lees hier onze bevindingen, conclusies en aanbevelingen.
data-engineer

Vacancy: Data Engineer / Project Lead

Justice for Prosperity is looking for an independent data engineer/developer. Please read the details in the PDF below. (For English: see page 2)

vondelkerk

Vondelkerkbrand wordt gebruikt om te stoken. Nee, het was geen aanslag.

Net na 01.00uur zagen we online al een stroom aan valse claims, ook vanuit internationale hoek. NL influencers, Russisch gezinde en Engelstalige netwerken duidden de brand als een aanslag, zogenaamd gepleegd door “moslimnetwerken” die christelijk Europa in de as zouden willen leggen. Een aanslag. Ook het omvolkingsframe dook vrijwel direct