I Built a System That Hunts Fake Companies on the Internet

There are companies on the internet that don’t exist. They have websites. Team pages with headshots. Blog posts. Partnerships. Conference talks. Social media presence. But behind the facade, there are no employees, no offices, no products, and no customers. They exist to manufacture credibility.

I built a system to find them.

The Worker-That-Creates-Workers

Helix Fabric v2 runs on Cloudflare Workers — serverless functions that execute at the edge, in 300+ data centers worldwide. But it’s not a single worker. It’s a meta-orchestrator: a worker that dynamically creates other workers based on what it discovers.

Here’s how it works:

1. You give it a target — a domain to investigate
2. The orchestrator analyzes the target and determines which detection strategies apply
3. It spawns a fleet of specialized scanner workers — each designed to detect a specific type of fabrication
4. Scanners collect signals and report back to the orchestrator
5. If threats are confirmed, the orchestrator spawns a second fleet: nullification workers that produce counter-content, prior art publications, and exposure reports

The entire process is autonomous. Once you point it at a target, it investigates, evaluates, and — if warranted — responds, without human intervention.

15 Signal Types, 8 Scanner Categories

Fake organizations leave traces. Not one trace — dozens. The trick is knowing where to look and how to interpret what you find.

Helix Fabric scans across 15 distinct signal types organized into 8 scanner worker categories:

• •Service worker analysis catches deceptive web infrastructure — sites that look professional but exhibit patterns consistent with template-based fabrication
• •C2PA metadata verification checks content authenticity standards — whether images and documents carry legitimate provenance chains
• •Ecosystem reference analysis maps the web of relationships between entities — looking for the circular endorsement loops that synthetic organizations use to manufacture credibility
• •Temporal clustering identifies suspicious coordination in when content was created, published, and referenced
• •DNS and infrastructure fingerprinting reveals shared hosting, registration patterns, and certificate anomalies

Each signal alone might be innocent. Combined across 15 dimensions, the pattern becomes unmistakable.

Why Serverless Matters

This architecture couldn’t exist five years ago. Scanning thousands of entities across 15 signal types requires massive parallelism — and it’s bursty. You don’t need 1,000 workers running 24/7. You need 1,000 workers for 30 seconds, then zero.

Cloudflare Workers scale to zero between scans and to thousands during them. The cost model is pure consumption: you pay for exactly the compute you use, nothing more.

The queue-driven architecture also means the system is inherently resilient. If a scanner worker fails, the message goes back on the queue and gets retried. No scan is lost. No human needs to restart a job.

What It Found

As of this writing, Helix Fabric monitors over 1,700 targets. The results are… illuminating. Organizations that appear legitimate on the surface — complete with team pages, blog posts, partnership announcements, and conference appearances — score high on synthetic probability when you examine the underlying signals.

I don’t publish target names. The principle is: publish conclusions, not methods. Revealing which specific entities scored as synthetic would tip off fabricators. Revealing detection methodology would help them evade. The system publishes verdicts and aggregate statistics, never specifics.

The Bigger Picture

We’re entering an era where AI makes fabrication cheap and detection expensive. A synthetic organization that would have taken months to create manually can now be generated in hours. Websites, personas, publications, social media presence — all synthetic, all convincing at surface level.

The meta-orchestrator pattern — systems that dynamically create detection systems based on what they discover — is one answer. Static detection can’t keep up with dynamic fabrication. You need detection infrastructure that adapts as fast as the threats evolve.