{"client_id":"demo","count":7,"findings":[{"id":"5be18ef6-8d0e-4b84-a518-7a05d3e58988","timestamp":"2026-09-27T16:15:43.298011+00:00","source":"domain_monitor","source_url":"DNS: democorp.example","title":"DNS resolution failure for democorp.example","content":"Domain democorp.example does not resolve in DNS. Possible takeover or configuration issue.","matched_keywords":["democorp.example"],"severity":"high","client_id":"demo","entity_type":"domain","entity_value":"democorp.example","raw_metadata":{},"false_positive":false,"reviewed":false},{"id":"8aac9bf8-c269-47c3-b896-d36516626adf","timestamp":"2026-09-27T13:44:13.081092+00:00","source":"github","source_url":"https://github.com/example/repo/blob/main/config.env","title":"Leaked .env file with database credentials on GitHub","content":"A public GitHub repository contains a .env file with what appears to be database credentials and API keys associated with the client domain. The repository appears to be a development fork that was made public by mistake.","matched_keywords":["democorp","democorp.example"],"severity":"critical","client_id":"demo","entity_type":"domain","entity_value":"democorp.example","raw_metadata":{"repo":"example/dev-fork","file_path":"config.env"},"false_positive":false,"reviewed":false},{"id":"be26a883-1e83-425c-9670-b0ad3e7042e7","timestamp":"2026-09-27T10:44:13.081092+00:00","source":"paste_site","source_url":"https://pastebin.com/abc12345","title":"Credential dump on Pastebin mentions client domain","content":"A paste on pastebin.com contains what appears to be a list of email addresses and password hashes. Several entries use the democorp.example domain, suggesting a potential credential leak from the organization.","matched_keywords":["democorp.example"],"severity":"high","client_id":"demo","entity_type":"domain","entity_value":"democorp.example","raw_metadata":{"paste_id":"abc12345"},"false_positive":false,"reviewed":false},{"id":"ac566faf-16aa-4dfc-96d5-81db714f425a","timestamp":"2026-09-27T03:44:13.081092+00:00","source":"reddit","source_url":"https://reddit.com/r/cybersecurity/comments/example","title":"Discussion on r/cybersecurity about Demo Corp security practices","content":"A thread on r/cybersecurity discusses Demo Corp's recent security practices. The thread includes some criticism of their incident response time and mentions potential vulnerabilities in their web infrastructure.","matched_keywords":["Demo Corp"],"severity":"medium","client_id":"demo","entity_type":"company","entity_value":"Demo Corp","raw_metadata":{"subreddit":"cybersecurity","score":42},"false_positive":false,"reviewed":false},{"id":"11dae984-2945-4a2c-9469-bf1bd1a46562","timestamp":"2026-09-26T19:44:13.081092+00:00","source":"certificate_transparency","source_url":"https://crt.sh/?q=democorp.example","title":"New SSL certificate issued for api.democorp.example","content":"A new SSL certificate was issued for api.democorp.example via Let's Encrypt. This may be legitimate but should be verified as no corresponding deployment was announced.","matched_keywords":["democorp.example"],"severity":"medium","client_id":"demo","entity_type":"domain","entity_value":"democorp.example","raw_metadata":{"issuer":"Let's Encrypt","common_name":"api.democorp.example"},"false_positive":false,"reviewed":false},{"id":"6fef73a6-6a5d-4aff-bf9c-b9b4b27562e6","timestamp":"2026-09-25T15:44:13.081092+00:00","source":"reddit","source_url":"https://reddit.com/r/netsec/comments/example2","title":"John Demo mentioned in netsec thread about executive credentials","content":"A post on r/netsec mentions executive John Demo in the context of a broader discussion about credential reuse among C-suite executives. No direct credential leak identified, but the mention creates reputation risk.","matched_keywords":["John Demo"],"severity":"low","client_id":"demo","entity_type":"executive","entity_value":"John Demo","raw_metadata":{"subreddit":"netsec","score":15},"false_positive":false,"reviewed":false},{"id":"a5937dcb-ddd3-4114-8d67-320ddf7700c0","timestamp":"2026-09-24T15:44:13.081092+00:00","source":"domain_monitor","source_url":"DNS: democorp.example","title":"New subdomain detected: dev-democorp.example","content":"A new DNS record was detected for dev-democorp.example. This subdomain was not previously registered and resolves to an external IP address. Possible subdomain takeover risk.","matched_keywords":["democorp.example"],"severity":"medium","client_id":"demo","entity_type":"domain","entity_value":"democorp.example","raw_metadata":{},"false_positive":false,"reviewed":false}]}