Fictional sample.Every person, company, domain, account and wallet in this report is invented. It shows the format and depth of a real deliverable, abridged.
Complex Investigation sample report
Daria Vellacourt
Cross-domain procurement fraud case, fictional subject
- As of
- Handling
- Confidential. For the client and the stated purpose only.
- Evidence items
- 9
Intelligence requirement
For the client's internal investigations team: a procurement manager is suspected of steering contracts to a supplier she secretly controls. Map any link between her, the supplier and the payments.
Lawful purpose recorded in the case gate: Fraud, corruption or misconduct investigation (fraud_investigation).
Scope and exclusions
In scope
- The subject, her corporate interests and the officers of those companies
- The supplier, its officers, domains and infrastructure history
- Reported credential exposure on the supplier's domains
- Public accounts and wallets tied to the supplier's infrastructure
- Legal entities tied to those accounts and wallets
Not included
- Non-public records, bank or account data, and anything behind a login we do not lawfully hold
- Leaked credentials or breach contents: only the fact that an exposure was reported is recorded
- Locating or contacting any person, pretexting or covert approaches
- Health, religion, sexual life, ethnic origin or other protected traits
- Interviewing the subject or her colleagues
- The client's internal email and payment records, which the client reviews separately
Executive intelligence assessment
A chain of nine links connects the subject to the supplier and to a company receiving payments. The corporate links are confirmed by registries. The infrastructure and account links are assessments of medium to low confidence. Together they justify an internal interview and a records review, not a conclusion of fraud.
Key findings
The subject holds 50% of Orrin Tallow Trading Ltd.
FactConfidence: ConfirmedEvidence: E-X-0001
Marek Ostrel is director of both Orrin Tallow Trading Ltd and the supplier, Quorvane Logistics Ltd.
quorvane-logistics.example and tallow-trade.example shared one hosting address in 2023.
AssessmentConfidence: MediumEvidence: E-X-0005
A wallet on a forum profile reusing the supplier's mail prefix received funds also sent to Brask Meridian Ltd.
Entity and relationship graph
Link 1: Daria Vellacourt holds 50% Orrin Tallow Trading Ltd (Company A)
FactConfidence: ConfirmedEvidence: E-X-0001
Link 2: Orrin Tallow Trading Ltd director of Marek Ostrel (Director)
FactConfidence: ConfirmedEvidence: E-X-0002
Link 3: Marek Ostrel also director of Quorvane Logistics Ltd (Company B)
FactConfidence: HighEvidence: E-X-0003
Link 4: Quorvane Logistics Ltd operates quorvane-logistics.example (Domain)
FactConfidence: HighEvidence: E-X-0004
Link 5: quorvane-logistics.example shared host with company a's domain Hosting address, 2023 (Historical infrastructure)
AssessmentConfidence: MediumEvidence: E-X-0005
Link 6: Hosting address, 2023 account on the domain reported in a breach Exposed staff account (Breach indicator)
AssessmentConfidence: MediumEvidence: E-X-0006
Link 7: Exposed staff account reuses the account's mail prefix Forum profile (Related account)
HypothesisConfidence: LowEvidence: E-X-0007
Link 8: Forum profile publishes Wallet bc1q...example (Wallet)
FactConfidence: MediumEvidence: E-X-0007, E-X-0008
Link 9: Wallet bc1q...example named as payee by Brask Meridian Ltd (Related legal entity)
AssessmentConfidence: MediumEvidence: E-X-0009
Chronology
| Date | Event | Evidence |
|---|---|---|
| 2019-05 | Orrin Tallow Trading Ltd incorporated; subject takes 50% | Evidence: E-X-0001 |
| 2021-03 | Marek Ostrel appointed director of Quorvane Logistics Ltd | Evidence: E-X-0003 |
| 2023-01 | Both companies' domains resolve to one hosting address | Evidence: E-X-0005 |
| 2024-08 | Breach notification lists an account on the supplier domain | Evidence: E-X-0006 |
| 2025-10 | Wallet published on a forum profile using the same mail prefix | Evidence: E-X-0007 |
Contradictions and alternative hypotheses
The shared hosting address is a commodity provider used by thousands of small sites, so the overlap is coincidence.
Partly supported: the address hosted 212 other domains in 2023. Confidence kept at Medium.
The forum account belongs to an unrelated person who reuses a common prefix.
Open. Nothing else ties the account to the supplier; confidence kept at Low.
Intelligence gaps
- The beneficial owner of Quorvane Logistics Ltd: its register entry names a nominee.
- Whether the client's payments to the supplier reached the wallet. That needs the client's own payment records.
Analyst assessment
The corporate links are strong enough to open an internal case and ask the subject to declare her interests. Treat the infrastructure and wallet links as leads to test against the client's payment records.
Reviewer sign-off: a real report cannot be sent until it passes the QA rules and a second person, not the analyst, signs it off. Both names and the sign-off time go on the cover. This sample carries none.
Evidence index
| ID | Source | Class | Grade | Retrieved | SHA-256 |
|---|---|---|---|---|---|
| E-X-0001 | Company registry: shareholders, Orrin Tallow Trading Ltd | Authoritative | A3 | 2026-09-20 | 497548758b5f, truncated |
| E-X-0002 | Company registry: officers, Orrin Tallow Trading Ltd | Authoritative | A2 | 2026-09-20 | 00a915efdbe6, truncated |
| E-X-0003 | Company registry: officers, Quorvane Logistics Ltd | Authoritative | A2 | 2026-09-20 | 7e78cf684539, truncated |
| E-X-0004 | quorvane-logistics.example footer and imprint | Self-published | D2 | 2026-09-21 | 5f6450f192e4, truncated |
| E-X-0005 | Passive DNS history for both domains | Aggregator | C3 | 2026-09-21 | a78f9f3cc03d, truncated |
| E-X-0006 | Breach notification service, domain summary | Aggregator | C3 | 2026-09-22 | 2974aa72f017, truncated |
| E-X-0007 | Public forum profile page | Anonymous | E6 | 2026-09-22 | 082f4b290938, truncated |
| E-X-0008 | Public blockchain explorer, wallet transactions | Established | B3 | 2026-09-23 | a37300e82152, truncated |
| E-X-0009 | Brask Meridian Ltd invoice page naming the wallet | Self-published | D3 | 2026-09-23 | 3434cecf17e7, truncated |
Grade is the Admiralty code, set by rule: reliability A to F from the source class, credibility 1 to 6 from how many other independent sources support the same claim. Hashes in this sample are illustrative. In a real report each is the SHA-256 of the stored capture. How grading works