This lab uses public incident reporting and sanitized synthetic artifacts for defensive OSINT training. Real incidents are referenced for educational context only. The interactive data is fictionalized and must not be used to identify, contact, expose, or accuse real people.
Certificate Drift
Tie a certificate observation to the mirror before the public DNS change shows up anywhere.
Synthetic training evidence that stays internally consistent. Check the repository history, the timestamps, the hashes and the agreement between sources. Never extend the scenario to real people or infrastructure.
01Incident summary
A low-visibility forum account mentioned a certificate change two days before the map incident. On its own that claim proves nothing. The exercise collector kept a synthetic TLS observation with a serial, a validity window, a SAN list and a fingerprint. Your job is to work out whether the early post had access to a real technical change or simply made a generic warning.
02Analyst mission
Find the certificate serial that the mirror and status hostnames share. Normalize its not-before date. Show that it comes before the DNS redirect window.
03Review the evidence
Evidence route
Open the public repository and preserve these records before you draw a conclusion.
| Indicator Type | Evidence path | Analytical Context |
|---|---|---|
| Certificate observations | evidence/act-1/tls/certificate-observations.json | Compare the serial, the SANs, the validity window and the observation time. |
| Shadow post archive | evidence/act-1/tls/../../act-2/shadow-intel/public-posts.jsonl | Check whether the public clue came before the public evidence. |
This table shows file paths and Git refs in the public evidence repository. None is a live scanning target.
04Tasks
4 steps- 01
List every SAN on the observed certificate.
- 02
Keep the issuance time separate from the first collection time.
- 03
Compare both against the mirror DNS-change window.
- 04
Build the flag from the lowercase serial and the YYYYMMDD not-before date.
05Log your findings
Evidence Notebook
Use this panel to log individual threads of evidence. Your entries are saved locally in this browser only.
No evidence records logged yet.
06Write the report
Report Drafting Board
# CSINT Incident Lab Report ## Research Question Find the certificate serial that the mirror and status hostnames share. Normalize its not-before date. Show that it comes before the DNS redirect window. ## Summary No analyst summary provided yet. ## Fact - No forensic facts recorded in the notebook. ## Signal - No analytical signals logged. ## Inference - No alternative explanations recorded. ## Recommendation - No next-pivot recommendations recorded. ## Confidence Low ## Limitations No limitation notes entered. ## Source reliability Not assessed. Annotate each source with its reliability tier before publishing. ## Information validity Not assessed. Confirm whether each item is directly observed, reported, or inferred. ## Missing context Not recorded. List what data is missing or could not be verified from public sources. ## Next safe steps - No next safe steps specified. ## Sources used - No source references listed. --- Generated at: pending