Connection Analysis: Finding the Hidden Links

In 2016, a consortium of journalists sat on 11.5 million leaked documents, 2.6 terabytes of financial and legal records tied to a Panamanian law firm, with no obvious way to make sense of them. Working with Neo4j's graph database and Linkurious' visualization software, the International Consortium of Investigative Journalists built a network of more than 275k nodes and 400k relationships, connecting individuals, shell companies, and bank accounts that had no obvious link on paper. HSBC and its affiliates turned up as one of the network's biggest hubs, tied to more than 2,300 shell companies once the connections were actually mapped.

That is what connection analysis does: it turns a pile of disconnected records into a picture of who is actually linked to whom, and how. In investigative work, connection analysis (also called link analysis or, when mathematical measures are applied to the graph, network analysis) is the practice of identifying and mapping relationships between people, accounts, organizations, and infrastructure to reveal patterns that isolated records never show on their own.

In this article, we examine what connection analysis actually involves, the kinds of data investigators can connect using OSINT, the workflow that turns a single identifier into a mapped network, and the graph-based techniques and common mistakes that separate a rigorous investigation from a chart full of unverified lines.

What Is Connection Analysis?

Connection analysis is the process of examining the relationships between entities relevant to an investigation, rather than looking at each entity in isolation. An entity on its own, a name, a domain, a phone number, rarely tells an investigator much. The same entity connected to three others through a shared address or a reused account often tells a very different story.

Entities, or nodes, are the subjects of an investigation: people, usernames and accounts, email addresses, phone numbers, organizations, domains and IP infrastructure, physical locations, events, and other digital assets. 

Relationships, or edges, describe how those entities connect: one entity communicated with another, used it, owned it, was registered to it, shared it, appeared alongside it, transacted with it, or was located at it. A connection analysis graph is built from these two pieces, nodes and the edges between them, and nothing more complicated than that.

The terminology varies more than the underlying idea does. Network analysis often layers in mathematical measures, like centrality or clustering, on top of the same graph. Link analysis is the term most commonly used in investigative and law enforcement contexts, with a stronger emphasis on individual relationships than on aggregate network statistics. Visualization, the chart or graph a person actually looks at, is simply the representation of the analysis, not the analysis itself. A well-organized chart built on unverified links is still a weak investigation.

Why Connection Analysis Matters in Modern Investigations

Data relevant to an investigation is almost never sitting in one place. A person's identity might be split across a corporate registry, a domain registration, three social media platforms, and a leaked credential database, each of which shows a fragment without the full picture. Connection analysis is what pulls those fragments back together.

It matters because relationships often reveal more than any single record. People and organizations tend to reuse identifiers: the same email across multiple accounts, the same address on multiple registrations, the same phone number tied to unrelated businesses. Those reused details are exactly what allow investigators to link entities that were never meant to be connected in public. Graphs make it far easier to spot these indirect connections than scanning spreadsheets or documents ever could, and each new connection either generates a fresh lead or tests whether an existing hypothesis actually holds up.

That said, a connection is not proof of anything on its own. Two people sharing an old address, two companies once sharing a director, two accounts once posting from the same IP range, none of these are automatically evidence of wrongdoing or even a meaningful relationship. Context and independent verification are what separate a real finding from a coincidence that happens to look interesting on a chart.

What Can Investigators Connect Using OSINT?

Open-source data supports several distinct categories of connection, and the value comes from correlating across them rather than treating each category as its own separate search.

Identity connections trace a person across their digital footprint: a name leading to a username, a username to an email, an email to a phone number, and from there to social profiles and any aliases the person has used across different platforms.

Infrastructure connections work similarly for technical assets: a domain leading to an IP address, a TLS certificate, a hosting provider, a registrant, and from there to other domains registered by or hosted alongside the same infrastructure.

Organization and asset connections link a person to the entities and property tied to them: a person to a company, a company to its directors, a director to a registered address, and an address to other assets or entities registered at the same location.

Events and activities connect what someone did to where and when they did it: an account to a post, a post to a location or timestamp, and that activity to other profiles that appeared in the same place at the same time.

How Connection Analysis Works in an Investigation

Connection analysis is a structured process, not a single search followed by a chart. It moves through multiple stages, and skipping any of them tends to produce a graph that looks thorough but doesn't actually hold up.

Defining the investigative question comes first. A concrete hypothesis, such as whether a given company is genuinely independent of another, gives the rest of the process a target. Without one, collection tends to sprawl in every direction at once.

Choosing a starting entity means selecting the single identifier the investigation will build from: a person, an account, an email, a domain, or an organization. That choice shapes what the investigation can realistically uncover.

Collecting and normalizing data brings findings from different sources into consistent entity types, so a phone number found on one platform and a phone number found on another can actually be compared. This stage also covers resolving duplicates, determining whether two slightly different identifiers, two spellings of a name, two similar email addresses, actually represent the same real-world person or organization. Getting this wrong in either direction distorts everything built on top of it.

Mapping relationships records what actually connects each entity to another and why, rather than simply noting that a connection exists.

Following relevant connections means expanding the leads that are actually promising, one-hop and multi-hop relationships worth pursuing, rather than expanding every entity outward until the graph becomes unreadable. It also means testing time and location: two accounts posting the same content five years apart tell a different story than two accounts posting it the same week.

Verifying and documenting findings means returning to the underlying sources and recording where each piece of information came from, when it was collected, how reliable the source is, and the reasoning behind each connection. UNODC's methodology for criminal intelligence analysts treats link analysis the same way, as a structured analytical process built on documented reasoning, not simply a finished chart.

Graph-Based Investigation Techniques

Once a graph exists, several techniques help investigators get more out of it without turning the work into pure graph theory.

Path analysis finds how one entity connects to another, tracing the shortest or most relevant chain of relationships between two points that don't appear directly linked.

Centrality and key nodes identify the hubs and brokers sitting at the center of a network, the entities that connect otherwise separate clusters. HSBC's role in the Panama Papers graph is a clear example: a single entity tied to thousands of others, which made it one of the first places investigators looked once the network was mapped.

Cluster and community analysis identifies groups of entities with unusually dense internal relationships, often revealing an operational group or network that wasn't visible when entities were reviewed one at a time.

Shared-attribute analysis looks for accounts or entities that share identifiers, infrastructure, addresses, or devices, even when nothing else connects them directly. Synthetic identities, built from a mix of real and fabricated information, were behind roughly one in five first-party frauds detected in 2025, and shared-attribute analysis is often the only way to catch them, since no single record in a synthetic identity looks obviously fake on its own.

Temporal network analysis determines when relationships actually existed, testing whether apparently connected activity was coordinated or simply coincidental.

Multi-hop analysis investigates indirect connections, two entities linked through a third, while deliberately controlling how far the investigation expands so the graph stays focused on the original question.

Connection Analysis Use Cases in OSINT Investigations

Mapping criminal or coordinated networks uses connection analysis to identify roles within a group: who the intermediaries are, which entities function as hubs, and what infrastructure ties otherwise separate individuals together.

Fraud and scam infrastructure investigations connect the accounts, domains, phone numbers, and payment identifiers that fraud operations tend to reuse across supposedly unrelated schemes. Cybercriminals maliciously registered 77% of all domains used in phishing attacks in the most recent reporting year, a 36% increase over the year before, and bulk registration patterns like this are exactly the kind of shared infrastructure that connection analysis is built to surface.

Cyber actor and infrastructure analysis maps the domains, IP addresses, accounts, and aliases tied to a given threat actor, often revealing infrastructure reused across multiple campaigns that would otherwise look unrelated.

Identity and background investigations connect aliases and fragmented online identities across public sources, testing whether a person's declared history actually matches what's independently observable. INTERPOL describes this kind of operational analysis as identifying links between subjects, roles, and investigative leads, framing it as relationship-centered work rather than a simple records search.

What Modern Connection Analysis Tools Should Do

The right question isn't which tool has the most features, but which capabilities a given investigation actually needs. Modern connection analysis platforms should pull data from multiple sources at once, extract and normalize entities automatically, and support entity resolution so investigators aren't merging or splitting identities by hand.

Beyond collection, a capable platform should surface likely relationships automatically, support interactive graph visualization with multi-hop exploration, and layer in timeline and geospatial context so temporal and location-based verification isn't a separate manual step. Source provenance, the ability to trace every edge on a graph back to where it came from, along with notes, evidence attachment, and filtering for large graphs, all matter more as an investigation grows.

None of this replaces analyst judgment. The goal of good tooling is to reduce the manual work of collection and chart maintenance so investigators can spend their time on verification and interpretation, the parts of the process a tool genuinely can't do on its own.

Common Connection Analysis Mistakes

Treating association as causation is the most common failure. A shared address or a mutual contact establishes a connection, not a conclusion about what that connection means.

Assuming every link carries equal weight flattens a graph that actually contains very different kinds of evidence, a directly observed transaction and a loosely shared attribute are not the same strength of connection.

Expanding a graph until it becomes unreadable happens when every entity gets pulled outward without regard for relevance, burying the actually meaningful connections under noise.

Failing to resolve duplicate entities, or resolving them incorrectly by merging two different people or splitting one person into two separate nodes, distorts every conclusion drawn from the graph afterward.

Ignoring dates and changing relationships leads investigators to treat a connection from years ago as though it were still current, when the underlying relationship may have ended long before the activity in question.

Losing the source behind a graph edge turns a defensible finding into an unverifiable claim, since a connection that can't be traced back to where it came from can't be defended later either.

Treating centrality scores as evidence mistakes a mathematical property of the graph for a factual finding about the entity itself. A high centrality score means a node has many connections, not that it's guilty of anything.

Practical Example: One Email, One Network

Consider an investigation that starts with a single email address flagged in a fraud report. Searching that address turns up a matching username on a forum, observed directly through account registration data on the platform.

That username reappears on a second platform under a slightly different spelling, an inferred connection at this stage, since a similar username alone doesn't confirm the same person controls both accounts. Cross-referencing profile photos and posting patterns across the two accounts strengthens the link enough to treat it as probable rather than merely possible.

The second account is tied to a domain listed in its bio. Registration records show that domain shares a hosting provider with three other domains, an infrastructure connection worth investigating further, though shared hosting alone doesn't prove common ownership. Checking those three domains against public breach data turns up a phone number reused across two of them, an observed connection that ties the cluster together more concretely than the shared hosting did on its own.

At each step, the investigator should ask what the new entity actually is, why the connection exists, whether it's observed or inferred, and what still needs independent verification before it goes into a report.

The Takeaway

Connection analysis is what turns fragmented, isolated records into an actual investigative picture. A name, a domain, or a phone number rarely means much by itself, but the relationships between those pieces, who used what, who shared an address with whom, which accounts reused the same infrastructure, are where the real findings tend to live.

Graphs support that analysis; they don't replace it. A well-built chart still depends on entity resolution done carefully, sources preserved at every step, and an investigator willing to ask whether a connection actually means something before treating it as a conclusion. The strongest connection analysis work looks less like drawing lines between nodes and more like a disciplined process of collection, verification, and judgment that happens to produce a graph as one of its outputs.

FAQ

Is connection analysis the same as link analysis?

They describe largely the same practice. Link analysis is the term most common in investigative and law enforcement contexts, while connection analysis is used more broadly, including in adjacent fields like network traffic analysis. Both examine relationships between entities to reveal patterns that isolated records don't show.

What is network analysis in an investigation?

Network analysis is closely related to link analysis but typically applies mathematical measures, such as centrality or clustering, to the same underlying graph of entities and relationships, adding a quantitative layer to what is otherwise the same investigative practice.

What types of data can be used for connection analysis?

Investigators commonly connect people, usernames, email addresses, phone numbers, organizations, domains and IP infrastructure, physical locations, events, and digital assets, using relationships like ownership, registration, communication, and shared identifiers to link them.

What are graph-based investigation techniques?

Common techniques include path analysis, which traces how two entities connect; centrality analysis, which identifies hubs and brokers; cluster analysis, which finds densely connected groups; shared-attribute analysis, which spots reused identifiers or infrastructure; and temporal analysis, which tests whether connected activity actually overlapped in time.

How do investigators verify that a connection is meaningful?

By returning to the underlying sources behind each connection, checking whether the timing and context actually support the relationship, and distinguishing directly observed connections from inferred ones before treating any finding as a conclusion rather than a lead.

Want to see how connection analysis works in practice? Book a personalized demo with one of our specialists and discover how SL Crimewall helps investigators map relationships across accounts, infrastructure, and entities, turning fragmented open-source data into a connected, verifiable picture.