investigate-without-getting-made

Threat-model who might notice and what they would see, then match your posture: clean browser and VPN for public sites, aged persona accounts for logged-in platforms. Prefer archives and caches over live visits, and log every exposure event with a grade from clean to attributed.

The logged-in slip: viewing a target's profile while signed into a real account, which triggers viewer notifications and exposes your name. Other common burns include real phone numbers used for verification, reused passwords, and corporate network ASNs identifying your employer.

A commercial VPN suits ordinary sites but is blocked by some platforms and flagged as datacentre traffic. Tor offers strong anonymity but exit nodes are publicly listed, triggering blocks and account challenges, so it is wrong for persona accounts. Residential proxies look like consumer connections but carry sourcing and ethics concerns.

Fake accounts violate most platforms' terms of service, which is generally a contract matter rather than a crime, though the boundary varies by jurisdiction. Impersonating a real identifiable person or an official is criminal in many places. Decide with counsel and record the authorization in writing.

Create personas well before they are needed, with coherent name, locale, timezone, and interests, registered from their permanent egress. Age them with irregular, ordinary activity over time, never reuse identifiers across personas, and use them for observation only.

Challenges come from flagged egress IPs, datacentre ASNs, mid-session IP changes, or fingerprint inconsistencies. Do not switch IPs mid-session to escape, as that confirms the pattern; stop the session and assume a challenged account may be finished.