CONNECTED INVESTIGATIONS
Your evidence. One working case.
Connect stored domain evidence, preserve sources and record your assessment.
Loading your workspace…
Keep your research private
Sign in to create a case and search your permitted evidence. No private data is stored in this browser.
Sign inBEGIN AN INVESTIGATION
Start with a domain. Follow the evidence.
Create a case or resume one from your list. Stored Guardian scans, retained threat observations and reviewed campaign matches appear together.
No active scanning, provider queries or inferred attribution.
CASE DETAILS
Investigation
Investigate a domain
Stored evidence onlyExact-host matches from permitted stored records. No results means unknown. No target is visited.
SOURCE-LINKED EVIDENCE
Indexed connections
Public source evidenceCoverage and interpretation
Searches are bounded to 200 candidate saved scans and 200 candidate archived feed records, with up to 50 evidence rows and 20 reviewed campaign matches. Results are not a complete history. A URL host connection is structural, not a DNS observation. A campaign match is exact listed membership, not an attribution claim.
Pinned evidence
Revalidated source referencesPins show currently permitted stored records, not frozen copies. Deleted scans and withdrawn campaign records become unavailable. Your own findings remain until you remove them. Save changes before exporting.