Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.
Exit demoStart your workspace

Signal workspace

Lookalike domain reproduces the sign-in page.

Sign-in page is reproduced pixel for pixel on a confusable domain, and the credential form posts to a host with no ownership relationship to the brand.

Case queue
kestrelpay-secure.comNewly observed domainPhishing sitedocumented

Observed content

Your session expired for security reasons. Re-enter your Kestrel Pay email, password, and the six-digit code we have just sent to your phone to restore access. For your protection this verification link stops working in fifteen minutes and the account stays locked.
9 linked pages3 redirect hops2 capturesOpen source

Why we flagged it

Page is a byte-level copy of the official sign-in template, the domain was registered four days ago, and the form action targets an unrelated host.

88

severity

Relevance
97%
First seen
2 hr ago
Check version
sentinel-threat-v1

Signs of harm

credential-requestconfusable-domainno-ownership-link

Evidence

Each capture is hashed on write. The digest is what makes the record checkable later.

2 retained · 1 retried
  • Screenshotcrawl4ai-screenshot283 KB · 12 Mar 2026, 12:21 UTC

    sha256c8065c4f8933c60d4c17b023b368fcb86ea62ad0b73f4295b1ef71cf251964e9

  • Page archivecrawl4ai-archive76 KB · 12 Mar 2026, 12:21 UTC

    sha256da753f68fba1518938c3e5e03491c449a1150cc8da86a89f571c5a2cce1ce6a4

Capture attempts

  • Host returned 403 to the first two ladder rungs. Captured on the third attempt via residential egress.crawl4ai-screenshot · 12 Mar 2026, 12:19 UTC

Decision trail

Append-only. Every status change records who and why.

  1. detectedConfusable domain observed in search results four days after registration.Collector · System · 2 hr
  2. detecteddocumentedSign-in screenshot and form source archived after a blocked first attempt.Priya Raghunathan · Analyst · 2 hr