Mystery Box Supply Chain
— Investigative TV Documentary

An investigative journalist at a German TV production company was developing a documentary on mystery boxes — the consumer trend of buying packages of unknown, returned e-commerce goods. The story needed to show the infrastructure: who controls the supply chains, where goods originate, how distribution networks are structured, and whether systematic consumer fraud could be documented.

Investigative intuition is not evidence. The documentary required verifiable, source-documented intelligence that could withstand editorial and legal scrutiny before broadcast. I was brought in to build that evidence base.

The investigation ran in two structured phases. Phase 1 used Shodan and Censys to identify server networks associated with mystery box operators. DNS analysis via crt.sh and DNSlytics traced relationships between domains sharing infrastructure, registrar patterns, or SSL certificate chains. Phase 2 used Sherlock, WhatsMyName, and OpenCorporates to correlate usernames and trace corporate relationships between operators, and TgStat and MaveKite to map the Telegram and TikTok influencer networks amplifying the ecosystem.

The investigation also incorporated physical intelligence: AirTag tracking to document actual product flows, and forensic address recovery — chemical treatment and specialised lighting to restore redacted shipping labels and reconstruct supply chain origin points operators had deliberately obscured. A whistleblower provided corroborating evidence of systematic fraud.