Private digital intelligence bureau Lawful OSINT — Cyber monitoring — Due diligence
Analyst organising source and decision checks in a physical matrix
Editorial illustration

Open editorial reference · 2026

Digital verification matrix.

A structured starting point for checking an identity, domain, message, review, piece of evidence or decision. Each check states its useful question and the conclusion it cannot support alone.

How to read it

Choose the checks that answer the real question.

IIS editorial reference. Priorities 1 to 3 indicate a usual reading order, not a universal risk score. Adapt each check to scope, applicable law and the facts.

Priority 1 covers basic identity, destination or evidence checks; 2 helps test context and attribution; 3 supports follow-up. A priority number never replaces an assessment of harm.

Interactive reference

Explore 36 checks in six categories.

Results: 36

Identity and entities · Priority 1

Confirm the correspondent’s role

Return to an official source or channel separate from the received message.

Caution: A public profile does not prove who controls the account.

Identity and entities · Priority 2

Rule out namesakes

Compare several matching identifiers before attribution.

Caution: Name and city alone are insufficient.

Identity and entities · Priority 2

Qualify control relationships

Separate declared ownership, directorship and operational control.

Caution: A shared address does not prove common management.

Public infrastructure · Priority 1

Check the registrable domain

Read the main domain before subdomains and paths.

Caution: A padlock does not confirm site identity.

Public infrastructure · Priority 2

Date the observed certificate

Record issuance, covered names and observation time.

Caution: An old certificate does not prove a current service.

Public infrastructure · Priority 2

Avoid attribution by shared hosting

Check whether an address or provider is shared.

Caution: Technical proximity does not establish ownership.

Public infrastructure · Priority 1

Spot a lookalike domain

Compare spelling, context and official channels.

Caution: Similarity alone does not prove fraud.

Messages and channels · Priority 1

Compare display name and actual sender domain

Inspect the full address without replying to the message.

Caution: The visible name can be chosen freely.

Messages and channels · Priority 1

Call back using an independent number

Use a previously known or officially published contact.

Caution: The number in a doubtful message may be controlled by its sender.

Messages and channels · Priority 1

Classify a sensitive request

Separate payment, secrets, installation and document sharing.

Caution: Claimed urgency is no substitute for confirmation.

Reputation and narratives · Priority 2

Compare reviews with a baseline

Account for seasonality, volume and service incidents.

Caution: A single spike does not establish a campaign.

Reputation and narratives · Priority 2

Find the original claim

Separate the original source from republications.

Caution: Ten copies are not ten confirmations.

Reputation and narratives · Priority 2

Test relay independence

Compare timing, wording and distribution links.

Caution: Simultaneous repetition may be spontaneous.

Reputation and narratives · Priority 3

Choose a response channel

Address verifiable facts where a correction will help.

Caution: An overly broad response can amplify marginal content.

Evidence and timeline · Priority 1

Preserve URL and source

Keep the full address and apparent publisher.

Caution: A context-free screenshot cannot establish origin.

Evidence and timeline · Priority 1

Date observation and time zone

Separate publication, consultation and modification.

Caution: A capture date is not the date of the event depicted.

Evidence and timeline · Priority 1

Preserve original and working copy

Limit transformations and record necessary ones.

Caution: A hash alone does not prove initial authenticity.

Evidence and timeline · Priority 2

Mark unknown timeline intervals

Show what was not observed between events.

Caution: No trace is not proof of absence.

Decision and response · Priority 1

Assign a confidence level

Separate established, probable, possible and unknown with reasons.

Caution: Do not turn a judgement into an invented percentage.

Decision and response · Priority 1

Connect the signal to impact

Describe plausible consequence, urgency and people affected.

Caution: A dramatic signal is not always the highest priority.

Decision and response · Priority 2

Assign an action owner

Link measure, deadline and evidence of correction.

Caution: An ownerless recommendation is difficult to execute.

Decision and response · Priority 3

Set a review trigger

Revisit after a change in asset, actor or context.

Caution: A dated finding does not remain valid indefinitely.

Identity and entities · Priority 2

Verify the claimed mandate

Separate published role, signing authority and permission for this request.

Caution: A real job title does not automatically authorise action for the entity.

Identity and entities · Priority 1

Find an official contact route

Obtain details from a known site or register independently of the message.

Caution: A contact card copied into the message is not an independent channel.

Public infrastructure · Priority 2

Time-stamp an observed DNS configuration

Record public responses and time before linking a domain to a service.

Caution: Current DNS answers may not describe the state when the event happened.

Public infrastructure · Priority 3

Compare archived versions

Identify when a page or service changed, while recording archive gaps.

Caution: No archive does not prove no page existed on that date.

Messages and channels · Priority 1

Assess an unexpected attachment

Compare sender, request and format with the expected process without running the file.

Caution: A familiar filename or visible extension may conceal the actual content.

Messages and channels · Priority 2

Explain a change of channel

Check why a conversation moves from a known channel to a new chat service or URL.

Caution: A switch may be legitimate but still needs independent confirmation.

Reputation and narratives · Priority 2

Identify a paid ad’s origin

Preserve the sponsored creative, displayed advertiser and final destination.

Caution: A displayed advertiser name does not prove the brand owner approved it.

Reputation and narratives · Priority 2

Find the earliest available media version

Compare the earliest traceable post with later crops and captions.

Caution: The earliest version found may still be a later repost.

Evidence and timeline · Priority 1

Normalise times and zones

Keep the original time and zone before building a shared timeline.

Caution: Silent conversion can reverse the apparent event order.

Evidence and timeline · Priority 2

Log evidence transformations

Record export, copy, conversion, redaction and responsible person for each item.

Caution: A hash calculated after conversion does not describe the original.

Decision and response · Priority 2

Test an alternative explanation

State a plausible alternative and the observation that would distinguish it.

Caution: One coherent story can conceal weak attribution.

Decision and response · Priority 3

Set a review stopping rule

Define what is enough to decide, what remains unknown and when to reopen the case.

Caution: Searching without a precise question can add data without improving the decision.

FAQ

Using the matrix responsibly.

Is this a risk score?

No. Priorities describe a usual order of attention, not a universal score. The actual impact and urgency depend on the case.

Must all 36 checks be performed?

No. Select the checks relevant to the decision and record which ones were not applicable or could not be completed.

Can the dataset be reused?

The CSV and JSON files can be reused with attribution to IIS and preservation of their cautions and version date.

Provenance, version and reuse

IIS editorial reference, not a statistical dataset. Recommendations and scores are case-dependent reference points, not scientifically validated measurements.

Dataset version: . Stable record IDs connect the bilingual JSON and CSV exports. Keep the caveats with each definition or recommendation.

Primary portals and their scope · Dataset reuse conditions