L Locard
№ 01 Landing

Independent forensic practice — established 2026

Every parasite
leaves a trace.

We trace the operators behind parasitic SEO, link-graph manipulation, and aged-domain abuse — then assemble the evidence in a form that survives legal review and platform takedown filings.

Engage Locard → Read casework
№ 02 Services

What we investigate.

Locard accepts engagements only from verified domain owners and their counsel. Each engagement begins with a confidential brief, ends with a deliverable that can be filed.

  1. i.

    Parasite SEO investigation

    Third-party sites ranking on your branded or commercial queries through cloaking, content theft, or scraped product inventories. We identify the operators, document their infrastructure, and prepare the evidence package required for search-engine spam reports and DMCA filings.

  2. ii.

    PBN & link-network attribution

    Networks of private blog domains pointing at your competitors —or, in adversarial cases, pointing at you in preparation for a negative-SEO complaint. We attribute ownership through registrar timing, registry-ID deltas, shared analytics identifiers, and infrastructure overlap, and we name who is behind the network with the confidence required for legal action.

  3. iii.

    Aged-domain repurpose detection

    The dominant 2024–26 evolution of parasitic SEO: an attacker acquires a 10–15-year-old domain in an unrelated niche and quietly redirects it at a new target. The domain reads as authoritative to search engines while bearing no other fingerprint of the operator. We detect the repurpose window, recover the original brand identity from archive evidence, and tie the change to the new operator.

  4. iv.

    Backlink-flip auditing

    Historical donors that once linked to you now point at a competitor — sometimes through a single character change in the anchor URL. We catalogue the flips, preserve the live donor pages before they change again, and produce an audit trail for either a private dispute or a public report.

  5. v.

    Adversarial monitoring

    For ongoing engagements: continuous watch on a brand’s high-value queries, with weekly written reports on new parasitic appearances, repurposed donor domains, and infrastructure that resurfaces under new branding.

We do not undertake offensive work. Locard does not build networks, does not negotiate with operators on a client’s behalf, and does not perform reputation management. Our practice is attribution and documentation.

№ 03 Casework

Selected matters.

All names, niches, and identifying details have been redacted at the client’s instruction. The methodology is described as it was executed.

Case A·2024

Aged-domain capture, two operators, one team.

Two domains created in 2009 and 2010, both with continuous legitimate operation in unrelated international niches — Spanish-language adult video, German-language directory — appeared as competitors in the client’s query set during early 2024.

Hypothesis on intake
Coincidental new entrants to the market.
What the trace showed
Both domains exhibited content-language inversion, brand dissolution, and SSL-issuer change inside a 90-day window centred on Q1 2024. Their archive histories agree on the window with minute-level resolution.
Outcome
Two domains attributed to a single operator team. Evidence package delivered for use in registrar-abuse escalation. Case open.
Case B·2024

The five-domain shopping cart.

A client suspected three competitor domains of being a single network. Public WHOIS, scrubbed of contact details, gave no signal: three different registrars, three different hosting providers, three different ages.

What the trace showed
Two of the three were registered within two seconds of each other, with consecutive registry-internal identifiers — a signature of a single shopping-cart transaction. The third shared analytics identifiers with the second under a different proxy host. Two further domains, not on the client’s original list, surfaced via the same analytics identifier and joined the file.
Outcome
Network of five domains attributed to one operator. Spam reports filed. Three of five domains de-indexed within forty-five days.
Case C·2025

The donor that changed sides.

A client lost organic position on commercial queries over a six-month period without any obvious editorial or technical change on their own site. They suspected a Google update.

What the trace showed
Twenty-eight historical donors that once linked to the client now linked instead to a single competitor. Sixteen of the twenty-eight had been edited within a forty-day window eighteen months prior — a coordinated effort, not a drift.
Outcome
The flips were preserved before further editing. The client filed a private dispute. Settled out of public view.

Recent matters are not published until they are closed and the client consents in writing. Active investigations are not discussed with anyone, in any form.

№ 04 About

The practice.

Method

Locard works from public infrastructure: registry timing, DNS history, certificate-transparency logs, web-archive captures, and the live link graph. We do not buy backlink databases as a substitute for evidence — we use them as a starting point to be verified against primary sources.

Every claim in a Locard report is supported by a reproducible artefact. Every artefact is preserved before delivery, because operators routinely edit their infrastructure when an investigation begins to surface.

Tools

The practice maintains a private toolchain — code-named parasite-watch — that automates the data-collection half of an engagement. It does not replace judgement. It exists so that the human investigator spends time on the parts of the case that cannot be automated: the connections, the timing, the intent.

Operator

Locard is, at the time of this writing, a single-operator practice. The practice maintains its tooling — code-named parasite-watch — as a public codebase on GitHub, where the methodology can be inspected by anyone.

Real-name engagement and credentials are released to the client under NDA at the start of an engagement. Until then, the operator is pseudonymous by deliberate policy: this work occurs in adversarial niches, and a public identity becomes a target.

Engagement policy

We accept engagements from verified domain owners, their in-house counsel, or external counsel acting on their written authority. Verification is performed by DNS-record challenge or equivalent — a five-minute step that protects both sides.

We do not work for parties who decline verification, parties who decline to name the end client, or parties whose interests in the matter would put us in conflict with a previous client.

№ 05 Contact

First contact.

One email, one short description of the situation, and the domain or domains involved.

Direct

contact@locard.io

Replies arrive within two working days. Encrypted channels (Wire, Signal, PGP) are made available on request, after the first exchange.

  • What is the domain you own?
  • What did you observe, and when?
  • What outcome are you seeking — public report, private dispute, or platform takedown?
  • Are you represented by counsel, or are you the principal?

Unsolicited offers, agency reseller pitches, link-building proposals, and SEO-tool partnerships are not read. The mailbox above is for matters described on this page.