One indicator belongs to a threat actor. The rest of their infrastructure is somewhere in this graph, next to lookalikes, shared hosting and addresses that have changed hands. Find it, and be able to say why.
Type the same word as the room and everyone gets the same graph. Share the link in the address bar and they get the seed and the difficulty with it.
One graph a day, the same one on every machine, derived from the UTC date and always played at analyst. Your best for today is kept in this browser.
Five cases in order, each harder than the last. Your progress is kept in this browser.
The rules in four lines
Hover an artefact to read its card. It names the source behind every link, how reliable that source is, and what the evidence so far supports
Click to pivot in and open its links. A noisy artefact costs more pivots and more collection seconds; going back somewhere you have been is free
T calls it the actor's. Two independent lines is a confirmation, one is provisional, none is a guess. A wrong call costs 20 s and a pivot
Tab steps the links of where you stand · Enter pivots · B back · R re-centre · M mute · drag orbits, scroll or pinch zooms
Settings and achievements
Every artefact is fictional and generated from the seed. Nothing here resolves.