Case studies.

Three windows into our practical work: independent research and anonymized, authorized assessments. Names, domains, and details are changed or deliberately aggregated; we publish nothing that would enable abuse or identify the parties involved.

Independent security research · not commissioned, anonymized

CS-01

Brand protection research: global luxury brand

Challenge: Luxury brands are among the most frequently impersonated targets for fake shops and phishing. As independent research, we examined how heavily one global luxury brand is affected by domain abuse.
Scope: The brand's publicly observable domain landscape: typosquatting, lookalike, and homograph variants, plus suspicious new registrations.
Methodology: Systematic generation and screening of domain permutations, enrichment with registration and infrastructure indicators, manual verification, and prioritization of relevant hits.
Potential impact: Domains like these enable customer fraud and reputational damage, often long before the affected company notices.
Remediation: A prioritized watchlist, evidence preservation, and recommendations for takedown and monitoring processes.
Finding categories: Active lookalike domains carrying shop templates
Punycode variants with high confusion potential
Parked suspicious registrations as a possible staging step

Anonymized case study · authorized test

CS-02

Penetration test of a SaaS web application

Challenge: A fast-growing SaaS application needed an independent review before expanding its customer base.
Scope: Web application and API, authorized in writing, with a defined testing window and clearly bounded target systems.
Methodology: Manual testing combined with automated coverage and AI-assisted analysis; every relevant finding was manually verified and documented with evidence.
Potential impact: Individual findings would have allowed access to other customers' data.
Remediation: A prioritized action plan with concrete fixes; critical findings were resolved quickly and retested.
Finding categories: Access control weaknesses between tenants
Session handling weaknesses
Insufficient validation on API endpoints

Anonymized case study · authorized review

CS-03

Smart contract review of a DeFi protocol

Challenge: A Web3 team needed an independent look at its core contracts before mainnet deployment.
Scope: The central contracts (vault and role logic) at a pinned code revision.
Methodology: Manual analysis with automated assistance, attack-path reasoning across roles and permissions, and proof-of-concept validation where appropriate.
Potential impact: Left unfixed, third parties could have manipulated central protocol parameters.
Remediation: Reproducible findings with remediation guidance and a re-review after the fixes.
Finding categories: Access control weakness in a privileged function
Business logic edge case with economic risk
Unsafe assumptions about external calls

Facing a similar question in your company?

In a short intro call, we'll figure out which assessment fits your situation and what a sensible scope looks like.

Request a Security Assessment