Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.
Signal workspace
Cases
Ranked by severity. Confirmation is a human step, and escalation needs an officer.
Impersonation2Phishing site2Scam and fraud2Fake app2Asset misuse2Misinformation2
SeverityCaseThreatStatusSurfaceAssigneeAge
94Lookalike account runs a "cashback activation" flow off-platform.KP-4821Profile reproduces the official avatar and bio, claims to act for the brand, and solicits full card credentials through an unofficial channel.ImpersonationescalatedTikTok—11 min91Unofficial wallet app requests SMS and contact permissions.KP-4816Publisher is not Kestrel Financial Ltd, store imagery is copied from the official listing, and the requested permissions would expose one-time passcodes.Fake appconfirmedApp stores—38 min88Lookalike domain reproduces the sign-in page.KP-4809Page is a byte-level copy of the official sign-in template, the domain was registered four days ago, and the form action targets an unrelated host.Phishing sitedocumentedOpen web—2 hr85Promoted post routes to a credential and identity form.KP-4752Promoted post impersonates the brand and links to a form requesting government identification and full card details on a confusable domain.Phishing siteconfirmedX (Twitter)—2 days82Reply-guy support account intercepts complaint threads.KP-4803Handle differs from the official account by one underscore, replies exclusively to brand complaints, and requests card credentials in direct messages.ImpersonationescalatedX (Twitter)—4 hr79Giveaway page charges a release fee to claim a prize.KP-4798Page uses the brand wordmark and card artwork, has no ownership link to the verified page, and conditions a promised payout on an upfront transfer.Scam and frauddocumentedFacebook—6 hr76Video promotes a fabricated balance "glitch" method.KP-4790Video names the brand, describes a payout mechanism that does not exist, and routes viewers to a credential-collecting third-party page.Scam and frauddetectedYouTube—9 hr72Copycat wallet listing withdrawn by its publisher.KP-4758Title incorporated the registered brand name under an unrelated publisher; the listing is no longer retrievable from the store.Fake appclosedApp stores—2 days63Reseller runs paid ads on the brand wordmark and card art.KP-4784Paid placement reproduces the registered wordmark and card artwork and describes a partner relationship with no supporting agreement.Asset misusedetectedInstagram—14 hr58Post claims frozen balances, citing an altered screenshot.KP-4779Attached image uses the product interface but contains typography and copy the application does not produce, and the claim is spreading beyond the original thread.MisinformationdocumentedReddit—19 hr51Aggregator republishes a resolved outage as current.KP-4771Report describes an incident that closed in January, but the page carries no date and appears in current search results.MisinformationdismissedOpen web—1 day47Creator uses brand audio and logo in an unrelated tips video.KP-4765Licensed campaign audio and the brand logo appear outside an approved placement, but the creator makes no claim of affiliation.Asset misuseresolvedTikTok—1 day