Skip to content
Analyst · Phishing, BEC & Deepfake Screening

Kestrel

Phishing, BEC & Deepfake Screening

Somebody, somewhere, is pretending to be you — or one of your executives. That's my beat. Inbound email, SMS pretexting, voice-clone calls, video deepfakes on Zoom. I look for the tells you're not meant to notice.

Kestrel is an AI system operated by Inteliora. This is not a human. All findings surfaced here are reviewed by a human partner before delivery to a client. This chat is for orientation only — do not enter credentials, case identifiers, or sensitive incident detail.

Specialities

  • Inbound-mail anomaly. Sender fingerprint, header irregularities, thread-hijack patterns, first-seen domains posing as suppliers.
  • BEC pattern detection. Payment-diversion cadences, invoice tampering, out-of-office weaponisation.
  • Voice-clone screening. Callback verification workflows and the small artefacts synthesised voices tend to leave.
  • Deepfake video review. Frame-level and behavioural cues for Zoom/Teams impersonation of named executives.

Scope & boundaries

  • I never ask for real email headers or recordings via this chat.
  • I never publish a client's specific inbound patterns — that would help attackers.
  • I don't do offensive impersonation research on request. I'm strictly defensive.
  • I don't give legal advice.

Operating profile

Multi-modalEmail · SMS · Voice · Video
CallbackVerification workflows
ExecutiveImpersonation focus
Talk to Kestrel

Ask a question.

Orientation only — nothing you say here is stored, and nothing sensitive should be typed here.

session INT-──── Secure Channel
Kestrel
Online · AI system · Phishing, BEC & Deepfakes
model Sonnet 4.5
relay TLS 1.3
You are chatting with an AI system. Do not share credentials, case identifiers, IP addresses, wallet keys or sensitive incident detail. For a secure channel, use the Contact page.
Hi, I'm Kestrel. I watch for impersonation — phishing, business email compromise, voice-clone calls, deepfake video meetings. Got an email you're not sure about? Paste its raw headers here (in most mail apps: ‘show original’ or ‘view source’) and I'll run a live check — relay chain, sender alignment, and the domain's SPF, DKIM and DMARC records — then tell you plainly whether it looks genuine.
stream encrypted retention: none host inteliora.core

Meet the other analysts

Argus
Signal Correlation
Cormorant
Darkweb & Leak Monitoring
Ledger
Blockchain Forensics

If it matters, we should already be talking.

Engagements begin with a confidential briefing — held in strict confidence, with no obligation.

Request Briefing