Every public page is redacted to a defender-oriented level. Private evidence and sensitive indicators never appear here.
An authorized test demonstrated that a cluster of sponsor-provided accounts could progress farther than expected before linked-account controls intervened.
A fully synthetic conversation between two sponsor-provided test personas advanced to the external-contact stage before the expected intervention appeared.
A restricted sponsor test account regained a subset of capabilities through the recovery flow, leaving enforcement state inconsistent between services.
A scripted agent using sponsor-issued sandbox credentials maintained listing volume above the threshold documented in the program policy.
Investment fraud / romance scam
A coordinated cluster using overlapping personas, domains, and payment destinations.
Impersonation / marketplace fraud
Impersonation of delivery and recovery services targeting marketplace buyers.
A defender-oriented walkthrough of what an authorized cluster test revealed about intervention timing — and the control changes that followed.
Across four sandbox programs, the gap between detection and intervention explained more risk than detection quality itself.
Campaign intelligence from two validated clusters shows repeatable structure in payout destinations weeks ahead of loss events.
How S1ID submissions are corroborated, redacted and converted into defensive test cases rather than attack manuals.