One suspicious portal. Follow the connections.
Explore a fictional investigation that traces one portal through collection endpoints, backends, related sites, and deployment records.
Illustrative scenario · Fictional entities and simulated evidence.
No signup required to explore.
The connections, in context.
Start with one suspicious portal.
The fictional investor portal is the first visible asset. Select it to see what the simulated case record says.
01 / Starting signal
Illustrative scenario · Fictional entities and simulated evidence. The graph is a guided explanation, not a live scan or product screenshot.
Have a suspicious domain? Put it to the test.
Send one suspicious domain. Outtake will return a custom investigation to your inbox.
Start with your own signal.
Submit one suspicious domain to request a custom investigation.
Recon / sample investigation reportIllustrative · Not an actual caseWhat are you looking at?
This example starts with a single suspicious investor portal. Follow its two form paths and you find two collection endpoints, each linked to its own backend. Five other fictional portals use those same paths. Simulated deployment and build records then connect all six sites to two shared assets.
One suspicious portal. Six impersonation sites. Shared infrastructure behind them.One starting site, five additional sites
Login and later verification
One for each collection path
Control and template repository
The five-level evidence trail
Each box is a separate fictional asset. The lines are simulated relationships, not proof of a real operation.
- 01
The starting site
The fictional investor-alderstone.example portal is the first place we look. In this example, it has two separate form steps.
- 02
Where those steps lead
A simulated login flow points to gateway-investor.example/collect. A later verification flow points to secure-verification.example/submit. These are different destinations, not one combined endpoint.
- 03
What sits behind them
Simulated routing records connect the login endpoint to intake-07.example and the verification endpoint to intake-09.example. Those are two distinct backend paths.
- 04
The other sites
Three additional fictional portals use the login path. Two use the verification path. Along with the starting site, that makes six individual portals on the map.
- 05
Why the sites may be related
A simulated deployment manifest connects all six portals to deploy-console.example. Separate simulated build records connect them to build-library.example.
What this does, and does not, tell us.
In this fictional case, the map illustrates how a team could move from one site to a set of connected assets. It does not establish that any site is live, that information was submitted or stolen, who controls the assets, or that harm occurred. The counts are not actual customer findings or typical Recon results.
If this were a real investigation, a team would verify the sites, form destinations, routing records, and deployment evidence before deciding what to do next.
Illustrative scenario · Fictional entities and simulated evidence. This sample explains the interactive map above; it is not a live investigation or a customer result.
What’s connected to threats targeting your company?
Take the next step with Outtake’s existing Recon assessment.