Reputation under attack: investigating online smears, fake accounts and leaked documents

Illustration: a fake profile, a clone website and a leaked document examined with a magnifier

A reputation attack is investigated like any other cyber incident: preserve the technical traces before they disappear, rebuild the timeline and look for links between accounts, domains and documents. Posts can vanish within minutes, but evidence captured properly in the first hours remains usable with platforms, with your lawyer and, where relevant, in criminal proceedings.

Key points

  • Reputation attacks rely on fake accounts, clone websites, fabricated reviews, leaked documents and, increasingly, deepfake content.
  • Plain screenshots are easy to challenge; what matters is the date, the exact URL, metadata and a cryptographic hash of every saved file.
  • The source is usually identified through correlation: writing style, posting hours, shared infrastructure, repeated mistakes, links between accounts.
  • A document leak is also a security incident and may trigger duties towards the Romanian data protection authority (ANSPDCP) or, for NIS2 entities, towards DNSC.
  • The loss is not only reputational: lost customers, suspended contracts, response costs and management time.

What counts as a digital reputation attack?

A reputation attack is a coordinated or repeated action aimed at reducing trust in a person or an organisation. The most common forms are:

  • fake accounts using the victim’s name, logo or photo to post damaging content or to ask customers for money;
  • clone websites on look-alike domains that copy the company’s design and collect data or payments;
  • waves of fake reviews on maps, marketplaces or professional networks;
  • leaked or truncated documents: contracts, internal emails, staff lists, presented out of context;
  • AI-generated content: images, audio or video in which a person appears to say or do something they never did.

Speed is the common factor. False content spreads in hours, and its author deletes the traces as soon as it attracts attention. The order of your steps matters more than your public reaction.

Why it is a financial problem, not just an image problem

For a company, the damage shows up quickly: customers leaving after a viral review, partners asking for explanations, paused campaigns, executives spending days on damage control. When the attack runs through a clone site or a fake account requesting payments, there is also direct loss, borne by customers who paid an impostor.

For individuals the consequences are often heavier: lost professional opportunities, pressure on family, content that is hard to remove. In both cases, without solid evidence the dispute stays at “my word against theirs”.

The first 24 hours: documenting it properly

The instinct is to reply publicly or demand removal straight away. Removal may be necessary, but only after the evidence is preserved. Recommended order:

  1. Do not engage with the author. A reply can trigger deletion or escalation.
  2. Save the exact URL of every post, profile or page, not just the visual capture.
  3. Take full screenshots with date and time visible, including comments and share counts.
  4. Download original files (images, videos, documents), not recompressed copies forwarded through messaging apps.
  5. Archive the pages with a tool that keeps the page source, not only the image.
  6. Compute a cryptographic hash (for example SHA-256) of each saved file and record it in a log.
  7. Keep a log: who noticed, when, what was saved, where it is stored.
  8. Keep messages from customers who were contacted by the fake accounts.
  9. Only then report the content to the platform and request removal.

The hash is what turns a screenshot into verifiable evidence: any later change to the file changes the hash, so integrity can be demonstrated.

How is the source of an attack identified?

There is rarely a single item that names the author. Attribution comes from correlating several clues, each weak on its own but convincing together.

Fake accounts

Analysts look at the creation date, shared friends or followers, where the profile photos come from and whether they appear elsewhere, activity hours, recurring phrases and mistakes, and links to accounts already known.

Clone websites

A domain leaves traces: registration date, registrar, name servers, hosting address, TLS certificate, other domains on the same infrastructure, reused analytics or payment codes. The same actor often recycles these elements across campaigns.

Leaked documents

Internal documents carry metadata: author, creation and modification dates, versions, sometimes the computer or printer name. Comparing the leaked version with the company’s archive can show which stage it came from and who had access at that moment. Access logs for email, document platforms or printers complete the picture.

Deepfake content

For AI-generated images and recordings, the analysis covers generation artefacts, audio-video inconsistencies, the first place of publication and the path of distribution. Conclusions must be stated with care, including the limits of the method.

Table: attack type, traces to keep, who can act

Attack type Traces to keep Who can act
Fake account using the victim’s name Profile URL, numeric ID, screenshots, messages sent to third parties Platform (impersonation), lawyer, criminal investigation bodies
Clone website Domain, registration data, hosting, screenshots, payments reported by customers Registrar, hosting provider, bank, criminal investigation bodies
Wave of fake reviews Screenshots, dates, authoring profiles, common patterns Platform, lawyer
Leaked internal documents Leaked file, internal versions, access logs Management, data protection officer, ANSPDCP, DNSC (NIS2 entities)
Deepfake audio or video Original file, first publication, distribution path Platform, lawyer, criminal investigation bodies

Criminal or civil route?

The legal route is chosen by the injured party and their lawyer. Technically, some acts linked to reputation attacks may be relevant under the Romanian Criminal Code: illegal access to a computer system (art. 360), unauthorised transfer of computer data (art. 364), computer forgery (art. 325), or computer fraud (art. 249) when a clone site collects payments. Offences under art. 325 and art. 360-366 fall under the jurisdiction of DIICOT, the prosecutor’s office for organised crime and terrorism, according to Law 508/2004.

Whatever the route, the same question comes back: what happened, when, by what means, and how can it be verified. The answer comes from technical documentation, not statements.

A document leak is also a security incident

Once internal documents become public, the problem is no longer only about communication. If they contain personal data, GDPR article 33 requires, where applicable, notifying the supervisory authority within 72 hours of becoming aware. If the organisation is an essential or important entity under Romania’s GEO 155/2024, a significant incident also requires notifying DNSC: early warning within 24 hours, notification within 72 hours, final report within one month. See our NIS2 incident notification guide.

The technical investigation answers the question every authority will ask: how did the data leave the organisation, and has the gap been closed?

Prevention: what lowers the risk next time

  • monitor domains similar to yours and register the obvious variants in advance;
  • enforce multi-factor authentication on official social media and email accounts;
  • apply least-privilege access to sensitive documents and log every access;
  • label confidential documents and control versions;
  • keep a short response plan: who documents, who communicates, who decides on reporting to authorities;
  • train staff to recognise manipulation, including AI-generated content.

How ProDefence can help

Our cybercrime investigation service follows five stages: intake, preservation, analysis, documentation and remediation. Our role is technical: to establish what happened and document the evidence. You receive a technical report, evidence documented in a form usable in criminal proceedings, the technical indicators found (domains, accounts, infrastructure) and remediation measures. The decision to involve the authorities stays with you.

When an attack has already produced a large volume of material (screenshots, correspondence, complaints, platform replies), ProCIS turns it, for your lawyer, into a factual chronology with an index of people and accounts, cross-document links and identified gaps. ProCIS is currently contracted in Romanian, through procis.ro.

For prevention, our penetration testing and security audit checks how exposed your accounts and document systems are, while CysEdu, under the campaign “Analizează. Decide. Acționează.” (Analyse. Decide. Act.), trains people to recognise manipulation.

When a smear is part of a coordinated campaign, with several accounts repeating the same message, the analysis has to look at the narrative as a whole, not only at isolated posts. For such cases, CysFact NEXUS is the ProDefence decision-support platform for narrative analysis and coordinated response in the information environment.

Frequently asked questions

Is a screenshot enough as evidence?

A screenshot is a start, but it is easy to challenge. It should be backed by the exact URL, date and time, the original downloaded file, an archived copy of the page and a cryptographic hash of each file recorded in a log. That makes it possible to show later that the material was not altered.

Can I find out who is behind a fake account?

Sometimes, by correlating technical clues: creation date, shared connections, activity hours, reused photos, infrastructure shared with other accounts or sites. Identification data held by platforms is normally obtained only through legal procedures, at the request of criminal investigation bodies.

Should I request removal first or preserve evidence first?

Preserve the evidence first, then request removal. Once removed, the content may become inaccessible to you as well. If there is an immediate risk, such as a clone site collecting payments, documentation and reporting should run in parallel on the same day.

Must a leak of internal documents be reported?

It depends on the content and on the organisation’s status. If personal data is involved, notifying the data protection authority within 72 hours may be required. Entities covered by GEO 155/2024 must report significant incidents to DNSC. The technical investigation shows how the data left and whether the gap is closed.

How do I recognise a deepfake used against my company?

Typical signs are audio-video sync issues, unnatural details around hands, teeth or background, an unknown first source and an urgent request attached to it. No visual check is fully reliable, so the original file and its distribution path need technical analysis.

Do you work for individuals too?

Yes, the investigation service covers both organisations and affected individuals. For large case-file analysis through ProCIS, individuals without a lawyer are referred to a professional who can contract the service.

Sources

Alexandru Angheluș, ProDefence. Cybersecurity specialist and co-author of the guide “Artificial Intelligence & The Manipulation of Human Perception”, working on online fraud and manipulation campaign investigations.

Artificial intelligence and national security: what has changed and what we...Illustration: critical infrastructure and democratic processes connected under an AI shield
Skip to content