Skip to content
Prooflume

How an investigation runs

Nine steps, always in this order. Each one leaves a record you can replay afterwards, down to the millisecond a check returned.

Start an investigation
  1. 1

    You paste what you received

    A text message, an email, a link, a sender address, a phone number, a domain or an IP address. Up to 20,000 characters. Nothing in it is opened by your browser.

  2. 2

    Indicators are read out of it

    Links, domains, email sender domains, phone numbers in E.164 form, IP addresses and organizations named in the text. With live AI on, a model can propose more claims, but each one must match an exact span of your text or it is discarded.

  3. 3

    Required checks are planned by rules

    Each indicator triggers the checks its rules require. A named organization in our catalog always requires checking its official domain. The model never decides what gets checked.

    • url.inspect
    • domain.dns
    • domain.rdap
    • domain.lookalike
    • email.auth
    • phone.parse
    • org.verify
    • reference.trusted
  4. 4

    The checks run, and you watch them

    Links are requested once by an isolated fetcher that has no credentials and refuses private addresses, including after redirects. Every start, result and failure is recorded as an event, and the timeline you see is drawn from those events only.

  5. 5

    Paid lookups wait for your approval

    With third-party providers turned on, a reputation lookup (such as IPQualityScore for a phone number or IP) pauses the case and shows you the exact request. Reject it and the result stays unknown.

    • phone.reputation
    • ip.reputation
  6. 6

    What was found is followed

    Redirect targets, registered domains and resolved addresses become new subjects and get their own checks, so a link that hops to a second domain is checked on both.

  7. 7

    Verdict rules run over the evidence

    High risk, Suspicious, Low evidence or Unknown, from deterministic rules. A report needs every required check to have been attempted; a check that failed counts as attempted and its result is unknown.

  8. 8

    The report is written, with citations

    Live AI can write the narrative, but every sentence must cite evidence or it is dropped, and model text never becomes evidence. With AI off, the report is the observations themselves.

  9. 9

    You export it, redacted

    Download the report as JSON or HTML. Personal details are redacted on a best-effort basis; review the file before you share it.