Right click for Frame info and the culprit is usually identifiable and its usually Supersonicads. (If frame info doesn't come up you might need to click elsewhere to find the frame.)
But ofc this is too fiddly. Nordeus' partners should be clearly marked - its a transaction, both sides should be visible.