Understanding the problem
Defaced pages, strange redirects, emails sent without permission or encrypted files are signs of a breach. Understanding the root cause is essential to truly fix it rather than just "clean up".
When this service helps
- Your site redirects elsewhere or shows strange content.
- Customers received fake emails from your account.
- Files were encrypted or deleted.
- Your provider flagged malicious activity.
How it works
- 01First contact. Describe your situation via Telegram or the form, without sending sensitive data.
- 02Initial review. We assess feasibility and explain what can be established.
- 03Proposal. You receive scope, timeline and price in writing, with e-acceptance.
- 04Execution. Work starts after a 50% payment, made once the proposal is accepted.
- 05Report. Once the work is done, the remaining 50% releases the full report.
How we analyze
- Preserving logs and evidence before any cleanup.
- Analysis of logs, modified files and access accounts.
- Reconstructing the attack timeline.
- Identifying the exploited flaw and containment steps.
What you receive
- An incident report: likely origin, impact and timeline.
- Fix and prevention recommendations.
- Documentation useful for mandatory notifications and legal use.
Want your case assessed?
Describe the situation on Telegram. The initial review shows what can be established before any proposal.
Talk to a specialist (Telegram @investigacoesonline)Technical and legal limits
- Attributing an attack to specific people is rarely possible through technical analysis alone.
- The sooner you contact us, the more evidence can be preserved.
Frequently asked questions
Should I wipe everything and restore a backup?
If possible, preserve evidence first. Restoring without understanding the flaw can lead to another breach.
Do I need to notify a data authority?
Incidents involving personal data may require notification. Check with your legal adviser; our report helps.
Related guide: How to know if my company was hacked?