Skip to workspace
Sentinely

Operations

OverviewMentionsCases9OfficerMonitoring termsFeedsAnalyticsIntegrationsAPI & MCPSettings
Monthly volume1,284 / 5,000
System live
Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.
Exit demoStart your workspace

Signal workspace

Promoted post routes to a credential and identity form.

Paid placement routes through a redirect chain to a page collecting government ID alongside full card details, under the brand livery.

Case queue
Kestrel Pay Offers@kestrelpayoffersPhishing siteconfirmed

Observed content

Rate increase for existing members takes effect on Friday. Confirm your identity in ninety seconds to lock in the current rate before it moves, and your saved products carry over automatically. Members who do not confirm before the deadline move to the new standard rate.
88K impressions1.4K clickspromotedOpen source

Classifier assessment

Promoted post impersonates the brand and links to a form requesting government identification and full card details on a confusable domain.

85

severity

Relevance
94%
First seen
2 days ago
Classifier
sentinel-threat-v1

Harm signals

credential-requestconfusable-domainhigh-reach

Evidence

Each capture is hashed on write. The digest is what makes the record checkable later.

3 retained · 1 retried
  • Screenshotcrawl4ai-screenshot333 KB · 10 Mar 2026, 10:22 UTC

    sha256e54f346f6354ae3b240c79b15394bff628707d2f9554d99ef42e536404632ce0

  • Screenshotcrawl4ai-screenshot420 KB · 10 Mar 2026, 10:23 UTC

    sha256fc8a1191eac451976c5270cdd7b6f3183eb003dc4e7d62d7c5e0216dceb5c3f3

  • Page archivecrawl4ai-archive70 KB · 10 Mar 2026, 10:23 UTC

    sha2563b63bb1138aa18c9cd9ee047659ef30c770eb7bd53806111275c39dbd6d17790

Capture attempts

  • Rate limit reached on the recent-search window. Retried after the reset and captured.official-api · 10 Mar 2026, 10:16 UTC

Actions

Officer approval is required to escalate. Sentinely documents and recommends. It does not execute takedowns or make legal determinations.

Tags

paid placementidentity harvesting

Decision trail

Append-only. Every status change records who and why.

  1. detectedPromoted placement impersonating the brand, linked to a confusable domain.Collector · System · 2 days
  2. detected→documentedPost, identity form, and form source captured after a rate-limit retry.Priya Raghunathan · Analyst · 2 days
  3. documented→confirmedForm collects government identification alongside full card details, and the promoted placement puts it in front of existing members rather than cold traffic.Priya Raghunathan · Analyst · 2 days