Web-forensics use case
Preserve online fraud and impersonation evidence
Online fraud and impersonation evidence collection documents websites, adverts, social accounts, listings, communications, and payment-facing material that may be relevant to a suspected scam or false identity. It preserves the presentation and collection record for review; it does not prove fraud, identify an operator, or replace financial, legal, or law-enforcement investigation.
What this use case means
Online fraud and impersonation evidence collection documents websites, adverts, social accounts, listings, communications, and payment-facing material that may be relevant to a suspected scam or false identity. It preserves the presentation and collection record for review; it does not prove fraud, identify an operator, or replace financial, legal, or law-enforcement investigation.
Imitator websites and accounts can change names, domains, offers, contact details, and payment routes quickly. Search results, adverts, social posts, fake support pages, and marketplace listings can all be part of the same activity, while a single screenshot may lose the URL, redirect path, product offer, account identity as displayed, or technical context.
Common situations
When this workflow is useful
- Suspected imitator websites, fraudulent offers, fake support pages, or misleading advertisements
- Impersonation of brands, people, organizations, customer-service channels, or social-media accounts
- Preserving online material for fraud response, due diligence, brand protection, threat intelligence, or referral to appropriate authorities
Recommended process
A documented acquisition workflow
- Define the suspected activity and boundaries
Identify the claimed identity, relevant domains or accounts, observed offer, affected audience, time window, authorized actions, and prohibited interactions.
- Capture the presentation and pathways
Preserve landing pages, redirects, adverts, profiles, listings, contact details, visible pricing or claims, and relevant linked pages in the order they were observed.
- Record technical and account context
Document URLs, navigation, account or platform presentation, session activity, and available network context without exposing credentials or collecting unnecessary data.
- Preserve related artifacts
Retain screenshots, source material, media, downloads, logs, timestamps, hashes, and chain-of-custody records within the case.
- Report facts, indicators, and limitations
Describe the observed representations and relationships without asserting that a person or entity committed fraud unless qualified reviewers reach that conclusion.
Reviewable output
What the evidence package should explain
Offer and identity presentation
Pages, profiles, adverts, listings, branding, contact details, claims, and visible pricing document what a visitor was shown.
Navigation and source context
URLs, redirects, page structure, account presentation, and session activity can connect related online locations.
Technical collection record
Available network context, timestamps, hashes, logs, and acquisition records support later verification.
Reviewable case package
Structured evidence and reporting help fraud, legal, brand-protection, or intelligence teams assess the material.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Do not make purchases, send messages, submit credentials, or otherwise interact with a suspected fraud operation unless explicitly authorized and supported by a controlled procedure.
- A similar name, domain, or logo is an indicator for review, not proof of impersonation, ownership, or intent.
- Avoid recording payment credentials, personal data, account secrets, or unrelated customer information; use approved escalation and disclosure routes.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
What should be captured from a suspected scam website?
Capture the full visitor-facing journey that is relevant: the URL, redirects, pages, offer, claims, contact details, branding, visible prices, account or publisher presentation, and the time and method of collection.
Can Eviquire prove who operates a website or account?
No. It documents what online sources presented. Operator identity and relationships need corroboration through appropriate investigative methods.
Should an investigator test a payment or contact channel?
Only when necessary, authorized, and handled under an approved procedure. Transactions, communications, and financial evidence may need controls beyond web acquisition.
Why capture redirects and adverts?
They can show how a visitor was led to the material, the representations made along the path, and relationships between domains, campaigns, accounts, or offers.