Demonstration case
A worked investigation, start to finish
This walks one constructed case through every epistemic state, so you can see precisely where a finding is promoted and where it is held back.
The case
A support ticket that did not match any order
In this constructed scenario, an e-commerce brand receives a customer complaint about a delayed order it has no record of. That single ticket is the only starting information. What follows is how Guardian would take it from an anecdote to a documented case — and, importantly, which parts stay uncertain at the end.
- Day 1Signal
Signal: a checkout page on an unfamiliar domain
Observation across Commerce and Domain Watch surfaces a storefront reproducing the customer's product imagery on a domain registered eleven days earlier. At this point this is an observation and nothing more.
- Day 1Hypothesis
Hypothesis: a cloned storefront taking payment
The imagery match and the recent registration are consistent with a cloned storefront. Consistent with is not the same as established, and the report says so.
- Day 2Evidence
Evidence: captured with provenance
The storefront is captured with source URL, observation timestamp, retrieval method and a snapshot. Registration and certificate records are recorded. The evidence now exists independently of our description of it.
- Day 2Signal
Signal: two further look-alike registrations
Correlation surfaces two additional domains sharing the same hosting fingerprint. One serves the same template; one is parked.
- Day 3Verified incident
Verified incident: the live cloned checkout
An operator reviews the captured evidence against the stated criteria — reproduced imagery, active payment surface, no authorised relationship — and records the review. This finding is now a verified incident.
- Day 3Hypothesis
Hypothesis, not promoted: the parked domain
The parked domain shares infrastructure but serves nothing. It is scored as elevated risk and left explicitly as a hypothesis. It does not become an incident because it does not meet the criteria, and we do not promote it to make the report look stronger.
- Day 4Action recommended
Action recommended
A prioritised sequence: abuse report to the host and registrar for the live clone, a customer-facing official-channels notice, and re-observation of the parked domain in 30 days.
- Day 5Result
Report delivered
Three findings, one verified incident, two hypotheses, stated limitations, and a recommendation on whether continuous monitoring is warranted.
What this case does not claim
The honest ending
In this constructed case Guardian does not know who registered the domains, does not know whether any customer actually paid the cloned storefront, and cannot promise the host will act. It knows what was observed, when, from where, and what that supports. That is the product: a case someone else will take seriously, with its uncertainty stated rather than smoothed over.