Capabilities
What Ghost Ranger Limited does, said plainly. Engagements are scoped on a per-matter basis. We do not maintain a public client list and we do not solicit work outside of referral and direct inquiry.
OSINT Investigations
Subject mapping, attribution work, sanctions-exposure review, supply-chain due diligence, leak-source triangulation, and informational-attack triage. Engagements range from a single afternoon's quiet support to counsel through to multi-month investigative arcs whose final product never carries our name.
Our practice is observational and lawful. We work within the open-source surface: registries, court systems, public ledgers, archived web, social graphs, and the slow accumulation of fact that the adversary forgets to keep covered.
Applied Reverse Engineering
We maintain a working portfolio across the parts of the field most clients can never staff for in-house: TLS transport and fingerprint countermeasures, mobile-device attestation and integrity research, anti-censorship transport stacks, browser-automation systems that survive modern fingerprinting, and bespoke protocol analysis on any system whose behaviour our client needs to predict.
Some of this stack ships as open-source libraries. The larger part lives in private repositories on our own forge, on bare-metal infrastructure under our direct stewardship — not on shared cloud providers. Any system that can be observed, can be modelled.
Counter-Surveillance & Privacy Engineering
Adversary modelling for individuals and small organisations facing capable opposition. Traffic-analysis hardening, secure-communications review, device-posture audits, and protective-detail OSINT support. We work alongside counsel where the engagement is contentious.
Private Training Cohorts
By request, we run small private cohorts in OSINT tradecraft and in practical reverse engineering. Audiences include in-house counsel, newsroom investigative staff, protective details, corporate security teams, and serious independent researchers.
Tradecraft transfers cleanly; secrecy about tradecraft rarely serves anyone but the adversary. If you are learning to see, we will teach you to see.
Engagement
All work begins with a scoped conversation under NDA. Pricing is per engagement and depends on depth, time pressure, and the sensitivity of the matter. Retainers are available for ongoing counsel-side support and for institutions with continuous requirements.
We accept engagements from counsel, journalists, defense contractors, NGOs operating in hostile environments, and the small set of institutions whose security is in the public interest.