Case files
Synthetic, OPSEC-safe write-ups. We show the dead ends — that's the difference between a tool dump and an analyst report.
One street photo, no EXIF, no landmarks in frame. We pivoted from sun azimuth + a municipal manhole casting to a three-block radius — then killed two false positives by hand.
Outcome: City district confirmed; exact building narrowed to two candidates pending ground truth.
Read full log →Fresh Discord account, burner email, VPN IP. The break wasn't a breach dump — it was a partial recovery hint and a reused username from a 2019 forum scrape.
Outcome: Two accounts tied to same operator with high confidence; no doxxing published.
Read full log →Client asked 'are we in stealer logs?' Automated scanners said no. Manual Hudson + stealer correlation found a contractor Jenkins token in a combo list.
Outcome: Credential rotated within SLA; no production access confirmed.
Read full log →