This lab uses public incident reporting and sanitized synthetic artifacts for defensive OSINT training. Real incidents are referenced for educational context only. The interactive data is fictionalized and must not be used to identify, contact, expose, or accuse real people.
The Quiet Callback
Find the machine-like cadence in harmless synthetic telemetry and stop short of a malware or exfiltration claim.
Synthetic training evidence that stays internally consistent. Check the repository history, the timestamps, the hashes and the agreement between sources. Never extend the scenario to real people or infrastructure.
01Incident summary
A responder labeled the repeated callbacks as command-and-control traffic. The sample supports a regular timing pattern, a host, a path and a containment response. There is no payload in it, no transferred data and no executable. The better move is to report the pattern and its limits instead of turning periodicity into a malware family.
02Analyst mission
Work out the exact modal interval. Find the repeated request path. Write both the inference the data supports and the claims it does not.
03Review the evidence
Evidence route
Open the public repository and preserve these records before you draw a conclusion.
| Indicator Type | Evidence path | Analytical Context |
|---|---|---|
| Callback observations | evidence/act-3/telemetry/callback-observations.csv | Work out the consecutive deltas and the containment transition. |
| Analytical limitation | evidence/act-3/telemetry/analyst-note.md | Keep the cadence finding away from malware and exfiltration claims. |
This table shows file paths and Git refs in the public evidence repository. None is a live scanning target.
04Tasks
4 steps- 01
Work out every consecutive time delta before you pick the modal interval.
- 02
Record the host, the path, the response status and the bytes out.
- 03
Say what points to automation and what stays unproven.
- 04
Build the flag from the interval in seconds and the normalized path.
05Log your findings
Evidence Notebook
Use this panel to log individual threads of evidence. Your entries are saved locally in this browser only.
No evidence records logged yet.
06Write the report
Report Drafting Board
# CSINT Incident Lab Report ## Research Question Work out the exact modal interval. Find the repeated request path. Write both the inference the data supports and the claims it does not. ## Summary No analyst summary provided yet. ## Fact - No forensic facts recorded in the notebook. ## Signal - No analytical signals logged. ## Inference - No alternative explanations recorded. ## Recommendation - No next-pivot recommendations recorded. ## Confidence Low ## Limitations No limitation notes entered. ## Source reliability Not assessed. Annotate each source with its reliability tier before publishing. ## Information validity Not assessed. Confirm whether each item is directly observed, reported, or inferred. ## Missing context Not recorded. List what data is missing or could not be verified from public sources. ## Next safe steps - No next safe steps specified. ## Sources used - No source references listed. --- Generated at: pending