Directly present in reviewed material
Example: a message requests a cryptocurrency transfer.
← IOC.Belt
Method · synthetic V0
Show the basis. Preserve the uncertainty.
A useful assessment says what happened, where each claim came from, how strong the support is, what remains unknown, and which action is safe to take before certainty arrives.
Epistemic types
Not every sentence is the same kind of claim.
The label follows the claim through review, correction, and publication.
Reported by a named source
Example: an official warning describes the same payment mechanism.
Reasoned from facts and reports
Example: the sequence is highly consistent with impersonation fraud.
Asserted but not established
Example: the caller controls the account or infrastructure shown.
Five analysis lanes
One episode. Five checks.
- 01 / claimVerify the specific story through an independently found official route.
- 02 / behaviorMap trust, pressure, isolation, channel changes, and requested actions.
- 03 / technicalState what artifacts establish—and what they cannot establish.
- 04 / chronologyCompare the sequence with qualified public, platform, court, and official reporting.
- 05 / exposureFind what has already happened and which containment step cannot wait.
Evidence strength
Corroboration changes confidence—not identity by magic.
- 01Participant-reported
- 02Community-reported
- 03Repeated or correlated reports
- 04Technical or infrastructure correlation
- 05Platform or institution confirmation
- 06Regulator, law enforcement, or court finding
Lifecycle
Every record can change.
synthetic draft internal review required active public disputed corrected expired withdrawn
Public records require a review date, responsible reviewer, current state, and correction history. Stale or disproven material is not quietly left to rot.
Privacy boundary
Two ledgers. Never one database.
Help cannot be conditional on research consent. There is no automatic pipeline.
Case Vault
Minimum evidence for one person’s assistance. Short retention. No publication or training.
Pattern Ledger
Stages, tactics, evidence states, intervention, and outcome—only if safely consented and minimized.
IOC.Belt
Methodology, aggregate findings, synthetic examples, reviewed playbooks, and corrections.
V0 boundaries
The exclusions are part of the method.
No real submissions
No public identifiers
No named suspect profiles
No automated final verdict
No continuous collection
No recovery or tracing
No suspect engagement
No “safe” certification