What our report looks like

1. Summary

On 29 September 2026, Wholesaler Y B.V. paid a deposit to "Example Supplier Ltd", a company that presents itself on the website example-supplier.example as a wholesaler in the United Kingdom. Since then the supplier has not responded. The investigation established the following facts:

• The website's domain was registered 23 days before the first quotation (F1).
• The registration number on the website and the invoice belongs, in the UK companies register, to a different company that was dissolved in 2019; the name Example Supplier Ltd does not appear in that register (F2).
• The website shares texts and an analytics code with two other websites (F3).
• The photo of Person A, named as director, is a stock photo (F4).
• The invoice names a different payee for the account than the supplier (F5).
• The bitcoin address on the payment page received payments from several senders; the funds were forwarded to an address attributed to a crypto service provider (F6).
• No indication at all was found that Person B, a namesake in the Netherlands, is involved with the supplier (F7, exculpatory).

Not established: who runs the website, who controls the account and the bitcoin address, and whether Person A exists (chapter 6). This report contains facts and their reliability. Whether this is fraud, and which steps Wholesaler Y takes, is for the client and its lawyer to assess.

2. Research question

Which facts can be established from open sources and public registers about (a) the company presenting itself as Example Supplier Ltd and its website, (b) the persons named on the website and in the correspondence, and (c) the payment details on the invoice and the payment page?

Additional question from the client: is there a link between the supplier and Person B, an entrepreneur based in the Netherlands with the same name as the director named on the website?

3. Scope

• Subject: the website example-supplier.example, the company and persons named on it, and the payment details on the quotation, the invoice and the payment page.
• Period: online information from the registration of the domain (2 September 2026) up to and including the last capture (8 October 2026).
• Sources: open sources and public registers, plus the documents supplied by the client (annex 3).
• Outside the scope (not requested): contact with the persons involved and surveillance; NCRB carries out digital investigation only.
• Not investigated, because they are not lawfully accessible to a private investigation agency: restricted profiles and closed groups, and bank, telecom or other protected data.

The scope was agreed with the client in advance in the investigation plan, at a fixed price. Any extension, for example to the two other websites in F3, first requires the client's approval.

4. Method and accountability

Sources used: the domain's registration data (RDAP), the web archive of the Internet Archive, the source code of the websites, search engines and reverse image search, the UK companies register (Companies House), the Dutch trade register (KvK) and public blockchain data, with an analysis tool for the attribution of addresses.

Capture. Every online source was captured with date and time (UTC), the full URL, a screenshot and, where possible, a copy of the complete page. A SHA-256 hash value was calculated for every captured file and every document supplied (annexes 1 and 3). If a file is later changed, even by a single character, the hash value no longer matches.

Confidence levels. Every finding is given one of three levels:

• High established in an official register or a primary source (the original, the document supplied or the public blockchain), or confirmed by a second, independent source.
• Medium one reliable source, not independently confirmed.
• Low an indication from a source whose reliability is not established; not suitable as stand-alone support.

Facts and interpretation. Each finding first states the fact, with its source and capture. The interpretation below it is the investigator's assessment and is marked as such. Exculpatory findings are reported in the same way.

Lawfulness. The investigation was carried out under NCRB's Wpbr licence (POB 1737) and in accordance with the privacy code of conduct for private investigation agencies. Legal basis: the client's legitimate interest; the balancing of interests is recorded in the file. No fake accounts, no deception and no unauthorised access were used.

5. Findings

Seven findings, in the order of the research question. Each finding states the source, the time of capture, the annex and the confidence level.

6. What could not be established

• Who the registrant of the domain is: the registration data are masked and open sources give no answer.
• Whether Person A exists, and who runs the websites.
• Who holds the account and where the deposit went after receipt: bank data are not lawfully accessible to a private investigation agency.
• Who controls the bitcoin address and who the customer behind the address at the crypto service provider is: that cannot be established from open sources.
• Whether goods exist that could have been delivered.

These points are part of the outcome too. They show where open sources end, and which questions belong with the police, the public prosecutor or the client's lawyer.

7. Possible next steps

For consideration, without legal advice; that remains with the client's lawyer:

• Report the payment to Wholesaler Y's bank, with this report.
• File a police report; this report and its annexes can be attached.
• Have the lawyer assess which legal steps are possible.
• Keep the original e-mails, the quotation and the invoice unchanged; the hash values in annex 3 make it possible to verify later that they have not been altered.
• Do not approach Person B, and do not name Person B in correspondence or a police report on the basis of the name alone (F7).
• A follow-up phase can investigate the two other websites from F3, with its own scope and a fixed price or cost ceiling.

8. Annexes

Annex 1. Capture log (fictitious values)

Annex 2. Screenshots

In a real report, each capture is accompanied here by its screenshot, with the URL and time visible in the image. In this sample, two of them are shown as placeholders.

Annex 3. Documents received (fictitious values)

Annex 4. Terms

RDAP

Registration Data Access Protocol: the standard through which registries and registrars publish the registration data of a domain name, such as the registration date.

Hash value (SHA-256)

A digital fingerprint of a file. The same file always gives the same value; any change gives a different value.

UTC

Coordinated Universal Time. All times in this report are in UTC, so that captures can be compared regardless of time zone or daylight saving time.

Attribution

Linking a blockchain address to a known service provider, based on the data of an analysis tool. An attribution is an assessment, not a register entry.

Analytics code

A code in the source code of a website that sends visitor statistics to an analytics service. The same code on several websites can point to a common operator.