Investigation Case Files
Illustrative composite examples. Each case file combines and alters details from several scenarios to show how a public-source review is scoped, checked by an analyst, and handed off. None describes a specific customer or promises a result.
Use the compare sample report to field cases view when you need to see how the report format relates to these illustrative case files.
Illustrative composite example
Documenting a Telegram Crypto Scam's Public Wallet Trail for Counsel
An investor who lost funds to a Telegram-promoted yield scheme needed the public blockchain path and channel evidence organized before filing reports.
Illustrative composite example
Checking a Dating Match's Photos With Facial Review and Reverse Image Search
A user asked for money by a dating match submitted the match's profile photos. Reverse image search and analyst facial review showed the photos were reused from unrelated public sources.
Illustrative composite example
Founder Due Diligence Finds an Unsupported Credential Claim on LinkedIn
A venture firm asked for public-source diligence on a startup founder. The review documented a credential claim that public records did not support, plus prior-company litigation context.
Illustrative composite example
Organizing Public Snapchat and Instagram Clues for a Missing-Teen Report
With documented guardian authorization, analysts organized a missing 16-year-old's last public posts and friends' public stories into a timestamped clue sheet for the family and police.
Illustrative composite example
An Executive's Reused Credentials Surfaced in a Breach Dump
Breach-reference monitoring flagged a senior executive's personal email in a newly posted credential dump. The review scoped password-reuse risk so the security team could act.
Illustrative composite example
Organizing Evidence of Repeated WhatsApp Harassment for a Protective-Order Filing
A client receiving threats from rotating WhatsApp numbers needed the messages, timing, and visible account details organized into an evidence file for their attorney.
Illustrative composite example
Documenting Impersonation Accounts That Reused a Creator's Content
A creator found fake accounts reposting their content and promoting lookalike subscription pages. Analysts mapped the public account cluster and prepared evidence for takedown requests.
Illustrative composite example
Preserving Discord Grooming Evidence for NCMEC and Law Enforcement
Parents found messages from an unknown adult urging their 14-year-old to meet in person. With documented guardian authorization, analysts preserved the evidence and prepared a report package for NCMEC and police.
Illustrative composite example
Following the Ethereum Trail: Documenting Ransomware Payment Flow to an Exchange
A mid-size company paid an Ethereum ransom. The review documented the public fund flow through a mixing service toward a regulated exchange touchpoint, with the mixer stage labeled as inference.
Illustrative composite example
Mapping the Public Bitcoin Trail Behind a Long-Running Romance Scam
A person who sent Bitcoin over several months to someone posing as a deployed service member needed the public transaction trail documented for a fraud report.
Illustrative composite example
CashApp Ticket Scam: How Public Complaints Linked 12 Seller Handles
A buyer lost money to a fake ticket seller on CashApp. Public scam reports and repeated listing language linked the seller's handle to a wider cluster of similar complaints.
Illustrative composite example
Documenting an NFT Project's Public Contract and Deployer-Wallet Trail
An NFT project went dark days after its public mint. The review documented the deployer wallet's public history and the exchange and developer-profile leads investigators could pursue.
Illustrative composite example
Pig-Butchering Scam: From a WhatsApp Message to a Public Website and Wallet Trail
A retiree lost savings to a fake crypto trading platform introduced over WhatsApp. The review documented the platform's public web infrastructure and the public wallet trail.
Illustrative composite example
Organizing a Runaway Teen's Public TikTok Clues for Police
With documented guardian authorization, analysts reviewed a 15-year-old's public TikTok videos for scene clues and handed a candidate-area note to police.
Illustrative composite example
Reviewing a Missing Adult's Public Reddit History for Place References
A family worried about an adult son's concerning public posts asked what his public Reddit history could tell police. Analysts organized his place references into a lead sheet.
Illustrative composite example
A Public Instagram Story Helped Narrow the Search Area for an Overdue Hiker
A hiker was overdue in a national park. Analysts reviewed the hiker's last public Instagram story for scene and timing clues that helped search teams prioritize one stretch of trail.
Illustrative composite example
Organizing Public Discord and Gaming Clues After a College Student Went Silent
Parents of an 18-year-old who stopped answering calls asked what public community activity could tell campus police. Analysts organized public and friend-shared clues into a welfare-check brief.
Illustrative composite example
Documenting a Public GitHub Repository That Mirrored Proprietary Code
A technology company found parts of its proprietary code in a public GitHub repository. Analysts documented the overlap and the repository's public commit history for counsel.
Illustrative composite example
Vetting a $10M Acquisition: Public Records Surfaced Undisclosed Lawsuits
An acquisition target appeared clean on paper. A multi-jurisdiction public-records review surfaced lawsuits and regulatory citations that were missing from the seller's disclosure schedule.
Illustrative composite example
Registry Review Links an Approved Vendor to a Finance Executive's Public Network
During an internal audit, public registry records connected an unexplained vendor to a person in a finance executive's public professional network. Analysts documented the link for outside counsel.
Illustrative composite example
Reviewing Video-Call Recordings for Synthetic-Media and Facial-Consistency Indicators
A person asked for money by an online partner shared recordings of their video calls. Analysts documented synthetic-media indicators and found the face imagery reused from public modeling photos.
Illustrative composite example
Reverse Image and Facial Review Map a Military-Impersonation Scam Network
Several people reported online partners who claimed to be deployed service members. Reverse image search and analyst facial review tied the profiles to photos taken from real service members' public posts.
Illustrative composite example
Documenting a Fake LinkedIn Recruiter Profile and Its Phishing Infrastructure
Employees of a tech company received recruiting messages that linked to a credential-harvesting page. Analysts documented the profile and the page's public infrastructure for the company's security team.
Illustrative composite example
Company Email Addresses Found in a Ransomware Leak-Site Dump
Breach-reference monitoring flagged a posted dump containing addresses on a client's email domain. Analysts scoped the exposure so the client's IT team could rotate credentials.
Illustrative composite example
Scoping a Dark Web Listing That Claimed to Hold a Hospital's Patient Records
A dark web listing claimed to sell a hospital system's patient records. Analysts documented the listing and its public sample description so the hospital's team could assess it internally.
Illustrative composite example
Mapping a Network of Instagram Storefronts Selling Counterfeits of a Fashion Brand
A luxury brand saw a surge of complaints about low-quality goods. Analysts mapped public Instagram storefronts reusing its trademarks and prepared evidence for platform reports.
Illustrative composite example
A Public Telegram Channel Selling Counterfeit Certificates With a Credentialing Body's Seal
A professional credentialing body found a public Telegram channel selling counterfeit certificates bearing its seal. Analysts archived the channel and documented its public payment trail.
Illustrative composite example
Identity-Theft Exposure Review: Mapping Where One Person's Leaked Details Appeared
After an unexpected credit alert, a client asked which breach references contained their details. Analysts combined breach-reference checks with the client's own credit reports into a response plan.
Illustrative composite example
Reducing Board Members' Public Exposure Ahead of an IPO
Before an IPO, a company asked for a review of what its board and executives exposed in public sources. Analysts mapped broker listings and public-post exposure and coordinated opt-out requests.
Illustrative composite example
Responding to Board-Member Doxxing Posts: Evidence Preservation and Escalation Review
After board members' home addresses were posted on public forums, analysts preserved the posts, traced where the details came from, and reviewed public mentions ahead of a shareholder meeting.
Illustrative composite example
Securing Executive Travel: Public-Source Monitoring During a High-Risk Summit
A company's security team asked for scoped public-source monitoring while its chief executive attended an international summit. Two public signals were escalated for the team's review.
Illustrative composite example
Enhanced Due Diligence: Ownership Records Link a Vendor to a Sanctions-Listed Individual
A standard name screen cleared a new vendor. An ownership review built from public registry filings documented a third-tier holding linked to an individual on a published sanctions list.
Illustrative composite example
AML Review: Public Company Pages and Registries Link Five Account-Holding Firms
A bank's monitoring flagged structured deposits across five business accounts. Public company pages and registry filings showed the firms shared a director, an agent, and the same stock imagery.
Illustrative composite example
Anti-Corruption Due Diligence: Public Records Surface an Undisclosed Official Relationship
Before a joint venture in an emerging market, public records and media review showed that the local partner's managing director had an undisclosed family tie to an official in a permitting ministry.
Illustrative composite example
Testing a Whistleblower Tip Against Public Records Before a Formal Investigation
An anonymous letter alleged self-dealing at a portfolio company. Analysts tested each allegation against public records so the investor could decide whether to open a formal investigation.
Illustrative composite example
Acquisition Diligence Finds a CTO's Public Side Product With Overlapping Code
During diligence on a SaaS acquisition, public launch listings and code repositories showed the target's CTO had released a similar product under a separate company name.
Illustrative composite example
Post-Merger Integration Risk: Reviewing an Acquired Company's Public Employee-Review Trends
After unexpected attrition following an acquisition, a buyer asked what public employee-review sites had shown beforehand. Analysts summarized aggregate sentiment trends for future diligence.
Illustrative composite example
Vendor Due Diligence: A SaaS Vendor's Advertised Team Was Not Supported by Public Evidence
A healthcare company about to sign a large SaaS contract asked whether the vendor's advertised 50-person team was real. Public evidence pointed to a far smaller operation.
Illustrative composite example
Competitive M&A Signals From Public Patent Filings and Job Postings
A private equity firm wanted to know whether a strategic buyer was pursuing the same target. Public patent filings and job postings at the company level suggested it was.
Illustrative composite example
Counterfeit Product Intelligence: Mapping a Fake-Goods Route From Wholesale Listings to a Marketplace
A consumer electronics brand found counterfeit units on a major marketplace. Public listings, wholesale catalogs, and import records mapped the likely route from factory to storefront.
Illustrative composite example
Trademark Squatting Across Multiple Countries: Mapping Bad-Faith Filings From Public Registers
A consumer brand planning international expansion found its mark already filed by unknown applicants in many target countries. Public trademark registers showed a shared filing pattern.
Illustrative composite example
Influencer Audit: Public Engagement Signals Flag Inflated Audiences Before the Next Campaign
After a campaign underperformed, a consumer brand asked for a review of its influencers' public follower and engagement patterns. A meaningful share showed signs of inflated audiences.
Illustrative composite example
Executive Impersonation on LinkedIn: Documenting Fake Partner Profiles Targeting Prospects
A consulting firm learned that fake LinkedIn profiles using its partners' names and photos were soliciting prospects for payments. Analysts documented the profiles for reporting and client notice.
Illustrative composite example
A Dark Web Listing Claimed a Retailer's Customer Data: Scoping the Exposure Before Disclosure
Breach-reference monitoring flagged a dark web listing that claimed to sell an e-commerce company's customer records. Analysts documented the claim so the company's incident team could assess it.
Illustrative composite example
Attack Surface Discovery: Public Records Surfaced 47 Undocumented Subdomains
A bank engaged an authorized external review of its public footprint. Passive public records surfaced 47 subdomains missing from its asset inventory, several running outdated software.
Illustrative composite example
Third-Party Risk: A Vendor's Public Repository Exposed Configuration Secrets
Scheduled review of a critical vendor's public code repositories found a configuration file containing API keys. The client's security team notified the vendor, which rotated the keys.
Illustrative composite example
Business Email Compromise: Mapping a Lookalike Domain's Public Infrastructure
A company wired funds after a spoofed executive email. Analysts documented the lookalike domain's public infrastructure and the payment chain the company's bank and law enforcement would need.
Illustrative composite example
Credential Exposure Monitoring: Employee Addresses Found Across Many Breach References
A large company's first credential exposure baseline found many employee addresses in breach references, some with reuse indicators, and set up recurring review.
Illustrative composite example
Social Engineering Readiness Assessment: How Much Do Employees Share on LinkedIn?
A defense contractor asked for an aggregate review of what its workforce publicly disclosed on LinkedIn. Public profiles exposed enough to reconstruct parts of its organization.