Skip to workspace
Sentinely

Operations

OverviewMentionsCases9OfficerMonitoring termsFeedsAnalyticsIntegrationsAPI & MCPSettings
Monthly volume1,284 / 5,000
System live
Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.
Exit demoStart your workspace

Signal workspace

Reply-guy support account intercepts complaint threads.

Account monitors public complaints about the brand and offers to resolve each one over direct message, away from any channel the support team can see.

Case queue
Kestrel Pay Help@kestrel_pay_helpImpersonationescalated

Observed content

Sorry about the delay on this one. Our team can release the hold right now. Send us the card number, the expiry date, and the phone number registered to the account by direct message, and we will have the funds back with you in a few minutes. No need to call support.
46 replies sent1.2K impressions18 followsOpen source

Classifier assessment

Handle differs from the official account by one underscore, replies exclusively to brand complaints, and requests card credentials in direct messages.

82

severity

Relevance
95%
First seen
4 hr ago
Classifier
sentinel-threat-v1

Harm signals

credential-requestofficial-insignia

Evidence

Each capture is hashed on write. The digest is what makes the record checkable later.

2 retained
  • Screenshotcrawl4ai-screenshot226 KB · 12 Mar 2026, 10:22 UTC

    sha2561dbffedd4b170d79eaa0dcc0d17932f03fb82007fb9e78676d86bf5bccc4c836

  • Listing metadataofficial-api7 KB · 12 Mar 2026, 10:22 UTC

    sha2568440a6f97f248e85d5c5fe581858caa75d1717d941efb36f272e3b5885909688

Actions

Officer approval is required to escalate. Sentinely documents and recommends. It does not execute takedowns or make legal determinations.

Tags

lookalike handlereply interception

Decision trail

Append-only. Every status change records who and why.

  1. detectedHandle matched the impersonation pattern for the official support account.Collector · System · 4 hr
  2. detected→documentedReply thread and profile record captured.Priya Raghunathan · Analyst · 4 hr
  3. documented→confirmedCredential request reproduced across four separate complaint threads.Priya Raghunathan · Analyst · 4 hr
  4. confirmed→escalatedReported to the platform under the impersonation policy. The credential request reproduced across four separate complaint threads, so reach is documented rather than asserted.Daniel Osei · Officer · 4 hr