Case files
Synthetic, OPSEC-safe write-ups. We show the dead ends — that is the difference between a tool dump and an analyst report.
Every file opens with the selector the analyst actually had — usually one photo, one handle, one domain. No retro-fitted perfect starting point.
Wrong automated guesses, discarded matches and failed pivots stay in the log. Removing them would make the rest of the file look cleverer than it was.
Each case closes with an outcome phrased the way it would be briefed: what was confirmed, what is pending, and what was ruled out.
Geolocation from shadow and infrastructure, identity from recovery metadata, exposure from a contractor laptop. Each one is annotated step by step.
One street photo, no EXIF, no landmarks in frame. We pivoted from sun azimuth + a municipal manhole casting to a three-block radius — then killed two false positives by hand.
Read · 8 minFresh Discord account, burner email, VPN IP. The break wasn't a breach dump — it was a partial recovery hint and a reused username from a 2019 forum scrape.
Read · 6 minClient asked 'are we in stealer logs?' Automated scanners said no. Manual Hudson + stealer correlation found a contractor Jenkins token in a combo list.
Read · 5 minThe console keeps the provenance these write-ups rely on — module, timestamp, raw response.
