Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.
Exit demoStart your workspace

Signal workspace

Promoted post routes to a credential and identity form.

Paid placement routes through a redirect chain to a page collecting government ID alongside full card details, under the brand livery.

Case queue
Kestrel Pay Offers@kestrelpayoffersPhishing siteconfirmed

Observed content

Rate increase for existing members takes effect on Friday. Confirm your identity in ninety seconds to lock in the current rate before it moves, and your saved products carry over automatically. Members who do not confirm before the deadline move to the new standard rate.
88K impressions1.4K clickspromotedOpen source

Why we flagged it

Promoted post impersonates the brand and links to a form requesting government identification and full card details on a confusable domain.

85

severity

Relevance
94%
First seen
2 days ago
Check version
sentinel-threat-v1

Signs of harm

credential-requestconfusable-domainhigh-reach

Evidence

Each capture is hashed on write. The digest is what makes the record checkable later.

3 retained · 1 retried
  • Screenshotcrawl4ai-screenshot333 KB · 10 Mar 2026, 10:22 UTC

    sha256e54f346f6354ae3b240c79b15394bff628707d2f9554d99ef42e536404632ce0

  • Screenshotcrawl4ai-screenshot420 KB · 10 Mar 2026, 10:23 UTC

    sha256fc8a1191eac451976c5270cdd7b6f3183eb003dc4e7d62d7c5e0216dceb5c3f3

  • Page archivecrawl4ai-archive70 KB · 10 Mar 2026, 10:23 UTC

    sha2563b63bb1138aa18c9cd9ee047659ef30c770eb7bd53806111275c39dbd6d17790

Capture attempts

  • Rate limit reached on the recent-search window. Retried after the reset and captured.official-api · 10 Mar 2026, 10:16 UTC

Decision trail

Append-only. Every status change records who and why.

  1. detectedPromoted placement impersonating the brand, linked to a confusable domain.Collector · System · 2 days
  2. detecteddocumentedPost, identity form, and form source captured after a rate-limit retry.Priya Raghunathan · Analyst · 2 days
  3. documentedconfirmedForm collects government identification alongside full card details, and the promoted placement puts it in front of existing members rather than cold traffic.Priya Raghunathan · Analyst · 2 days