Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.

Signal workspace

Monthly report

What was collected, what became a case, what was escalated, and what to do next.

Kestrel Pay — August 2026

Brand protection summary · prepared for the Kestrel Pay board

Illustrative data

Collected

1,284

raw posts and pages matched a monitored term

Worth reading

93% of volume discarded by the relevance gate

Cases opened

each with preserved evidence and a classifier reason

Escalated

officer-approved, with reporting routes prepared

Closed

resolved or dismissed after review

Impersonation pressure concentrated on TikTok and X this period: a lookalike rewards account reached 184K views before escalation, and a promoted credential form reused the Kestrel Pay wordmark. The relevance gate held review volume to 94 items, and every escalation carried preserved evidence and an official reporting route.

Notable cases

Highest severity this period, with their current state.

Lookalike account runs a "cashback activation" flow off-platform.

KP-4821 · TikTok

Impersonationescalated 91

Unofficial wallet app requests SMS and contact permissions.

KP-4816 · App stores

Fake appconfirmed 88

Lookalike domain reproduces the sign-in page.

KP-4809 · Open web

Phishing sitedocumented

Threat mix and coverage

Cases by classification, and the collection state behind them.

$4.51 / 24h acquisition

Impersonation2 cases · top 94

Fake app2 cases · top 91

Phishing site2 cases · top 88

Scam and fraud2 cases · top 79

Asset misuse2 cases · top 63

Misinformation2 cases · top 58

X (Twitter)OK

RedditOK

YouTubeOK

Open webOK

TikTokOK

InstagramOK

App storesOK

FacebookThrottled

Recommended actions

Keep the WhatsApp "rewards desk" language in the monitored terms — both high-severity impersonations used it verbatim.
Pre-register the two unregistered lookalike domains surfaced in case KP-4809 before the next campaign window.
Brief the support team on the fee-for-prize pattern so inbound customer reports are routed to the open case instead of new tickets.

Sentinely documents and recommends. Escalation requires officer approval, and external action stays with a human.

Recommended actions

Keep the WhatsApp "rewards desk" language in the monitored terms — both high-severity impersonations used it verbatim.

Pre-register the two unregistered lookalike domains surfaced in case KP-4809 before the next campaign window.

Brief the support team on the fee-for-prize pattern so inbound customer reports are routed to the open case instead of new tickets.

Sentinely documents and recommends. Escalation requires officer approval, and external action stays with a human.