Intelligence
Every failed verification is a sensor
Here is the part of Fromenance that we think matters most over time. Communication provenance answers the customer, and every time the answer is Not verified or Known fraud, you have just received a real impersonation attempt from the exact person it was written to fool. We pull the indicators out from day one; clustering them into campaigns, enriching the infrastructure, and warning other institutions early is the intelligence tier, and it is on the roadmap.
Why this signal
A sensor nobody else has
Threat intelligence vendors answer whether a piece of infrastructure is malicious. We answer whether you sent this message, and along the way we end up holding both halves of the picture: the authoritative record of what you sent, and the lures your own customers received and doubted.
What you sent
Every message you registered as you sent it, with a recipient bound code and a fingerprint of the text. Ground truth, not inference.
What your customers doubted
Lures convincing enough that a real customer paused and asked. Not a honeypot sample, not a feed of everything on the internet: the attacks actually reaching your customers this week.
In the box
What you get from the first submission
The schema, the indicator store, and the intelligence queue are there from day one, so nothing ever has to be backfilled.
Indicators from every non verified submission
URLs, domains, IPs, phone numbers, email addresses, QR payloads, and wallet addresses, normalized, with first seen, last seen, and how many times. Your own domains are skipped. Everything stays in your tenant.
The fraud list and Known fraud
An analyst marks a submission as fraud and its indicators and fingerprint join your fraud list. The next customer who gets that lure hears Known fraud in seconds. Entries never come from a single anonymous submission.
Replay flags
A copied verify footer is the attacker telling you which template they are imitating. We flag replay attempts with high priority and count them on your overview.
The template they are imitating
Every Not verified submission records the nearest registered template by fingerprint, so you can see which of your own messages a campaign is copying.
CSV and STIX 2.1 export
From the Indicators table or through the API. Bulk add to the fraud list from the same view.
Signed webhooks
verdict.created, submission.replay_detected, and indicator.new to your SIEM, SOAR, or takedown vendor. HMAC-SHA256 with a per endpoint secret, 24 hours of retries with backoff, replay from the delivery log.
Roadmap
The intelligence tier
We build this after a tenant is paying for verification, and the network layer after an analyst has confirmed a campaign from real submissions. That is a commitment to sequence, not to dates, and we would rather tell you that plainly.
- Roadmap
IOC enrichment
URL unshortening and redirect chain following in an isolated fetcher, a screenshot of the landing page to R2, TLS certificate fingerprint, hosting ASN, WHOIS age, and a phishing kit fingerprint from the landing page structure.
- Roadmap
Campaign clustering
Submissions cluster on shared indicators, fingerprint proximity (distance 10 or less), and kit fingerprint. Three or more in 72 hours becomes a campaign. Analysts name, merge, split, and close them.
- Roadmap
Campaign view
Timeline, members, shared infrastructure, a summary of the lure, the registered template it imitates, status, and one click export to your takedown vendor's webhook.
- Roadmap
Feeds
campaign.detected webhooks, STIX 2.1 and TAXII 2.1 endpoints, CSV, and Splunk and Sentinel saved searches in the docs.
- Roadmap
Automatic Known fraud
Once an analyst confirms a campaign, its indicators and fingerprints join the fraud list so later customers hear Known fraud in seconds. Confirmation stays with a person.
- Roadmap
Cross institution early warning
Correlation on indicators and kit fingerprints only, never on submissions or content. "Infrastructure associated with this campaign was observed targeting another financial institution 72 hours ago." No tenant ever learns who the other one is. Opt in.
Closing the loop
Where the indicators can go
Once you know about an attack, the indicators can feed the systems you already run.
- SIEM
- SOAR
- Email gateway blocklists
- Web and DNS security
- Takedown vendors
- Fraud platforms
- Contact center scripts
- Customer alert banners
Start with verification. The intelligence starts accumulating on its own.
A pilot on one stream produces the first indicators in the first week. The report at day 90 includes intelligence yield: the indicators your existing feeds did not have, checked by your own team.