Reference
Glossary
Every term a reader will hit in this corpus, defined in plain language. These are not generic words — the difference between two of them is often the difference between a finding and a guess.
Evidence-confidence labels
| Label | What it commits to |
|---|---|
| UNVERIFIED | A claim that outruns its evidence. Recorded because it may matter, labelled because nothing currently supports it. Must never be quoted as a finding |
| HYPOTHESIS | An inference from circumstances, stated as an inference. Proposes a specific explanation and names what would confirm it |
| PROVISIONAL | Probably correct but rests on an artifact not yet filed and hashed. Two findings in this case carry the label |
| ESTABLISHED | Supported by a filed, hashed artifact or a registry-attested record. The default for anything published without a qualifier |
| NEGATIVE RESULT | A finding that weakens or shrinks the case. Retained deliberately. Some are probative: a sweep of 98 photographs found zero cross-account reuse, which itself proves harvesting volume and detection avoidance (K-4) |
Party status taxonomy
| Token | Meaning |
|---|---|
| SCAM-INFRA | Infrastructure attributable to the operation: a domain, a page, a handle, a template string |
| STOLEN-CONTENT | Material taken from a real person or business |
| AI-ASSET | Machine-generated content: a logo, a persona photograph, a testimonial |
| UNDETERMINED | The evidence genuinely does not distinguish innocent from involved. A real status, not a placeholder for "probably guilty" |
| LIKELY-VICTIM | Assessed as harmed by the operation rather than part of it |
| CLEARED | Actively investigated and excluded. Not merely unexamined |
Interaction classification
| Class | Meaning |
|---|---|
| PASSIVE | Reading a publicly served page. No login, no form, no submission, and login state positively known to be logged out |
| ACTIVE-OUT | Something sent by the investigation to the operation. This is investigator conduct, and it is what a defence can attack |
| ACTIVE-IN | Something sent by the operation to the investigator. This is operator conduct, and it supports the case |
| ACTIVE-3P | Contact with a third party about the operation: an abuse desk, a registrar, a bank, a blocklist |
| UNRESOLVED | The facts needed to classify are not recoverable. A final answer, not a to-do item — guessing to close the field damages the record |
Forensics & infrastructure
| Term | Definition |
|---|---|
| SHA-256 | A fixed-length fingerprint of a file’s exact bytes. Change one byte and it changes completely. It proves the bytes are unchanged; it proves nothing about what the bytes mean |
| Manifest | A list pairing every file with its hash. This corpus has three, with different scopes |
| RDAP | The modern replacement for WHOIS. Registry-attested, so higher-grade evidence than anything an operator writes on a website. An RDAP 404 means the domain is not registered at all |
| pHash / dHash | Fingerprints that stay similar when an image is resized or re-encoded. Used to find the same photograph reused across accounts |
| EXIF | Metadata a camera embeds in a photograph. Most platforms strip it on upload — only 3 of 140 files retained any |
| ELA | Error Level Analysis. Produces suggestive pictures and is widely over-read. In this corpus, corroborative only, never probative (M-2) |
| Dork | A precise search query built from a distinctive string, used to enumerate every page containing it |
| Append-only | No file in the evidence tree is ever edited, renamed, or re-saved. Corrections are appended as amendments |
| Firewall | The rule that a name never moves from the victim column to the suspect column without new evidence |
| Contamination | Any interaction that puts investigator-originated traffic onto an operation’s surface |
| Chain of custody | The documented history of an artifact from capture onward: hashed before any move, moved without modification, re-hashed after |