Core Concepts
Learn how ANTID discovers, parses, verifies, and structures suspicious payment infrastructure into actionable intelligence.
How ANTID Works
ANTID is designed to detect, review, and structure intelligence related to suspicious payment infrastructure. The platform continuously collects signals from public digital environments where payment details appear, transforms fragmented findings into structured records, and supports review workflows that reduce noise and improve confidence.
Rather than treating each finding as an isolated artifact, ANTID links payment identifiers, resources, evidence, and review outcomes into a single operational intelligence layer.
Discovery Sources
Suspicious payment details can appear across a wide range of online environments. ANTID is built to monitor and process distributed sources where payment infrastructure is exposed, reused, or promoted.
Core Discovery Areas
Hosted payment pages, checkout flows, deposit forms, and transaction instructions where requisites are presented to end users.
Websites, landing pages, mirror domains, and other public-facing resources that expose or reference suspicious payment details.
Public channels, posts, and communication surfaces where payment instructions, identifiers, or account details may be shared.
External submissions, analyst findings, and intelligence contributions that enrich coverage and support collaborative investigations.
Collection and Parsing Pipeline
The ANTID pipeline is designed to handle fragmented, inconsistent, and fast-changing data across the internet. Signals are collected from multiple sources, parsed into structured fields, and normalized so that related records can be linked, compared, and reviewed consistently.
Intelligence Flow
- Discovery Layer - Public resources are monitored to identify pages, content, and environments where payment details appear.
- Capture Layer - Relevant material is captured as screenshots, source metadata, page content, and contextual evidence.
- Extraction Layer - Payment details, labels, identifiers, and supporting attributes are extracted from raw material.
- Normalization Layer - Extracted values are standardized into consistent formats to support matching, deduplication, and graph linking.
- Verification Layer - Signals are evaluated through automated checks and analyst review to separate weak findings from operationally useful intelligence.
- Registry Layer - Verified records are stored with evidence, source history, timestamps, and relationships to connected resources.
- Delivery Layer - Structured intelligence becomes available through the platform interface, internal workflows, and downstream integrations.
Verification and Review
Not every discovered payment detail should be treated as a high-confidence signal. ANTID applies a review-oriented process that helps distinguish raw internet noise from evidence-backed intelligence.
Review Principles
Findings are stored alongside screenshots, source references, timestamps, and supporting metadata so that analysts can validate how and where a signal was observed.
Repeated appearances of the same payment details are linked across sources, helping teams identify reuse patterns instead of reviewing every record as a separate case.
Human review supports status assignment, signal validation, and escalation decisions when additional context or judgment is required.
Records can move through operational states such as new, in review, verified, or dismissed, making the intelligence lifecycle visible and manageable.
Why Structure Matters
Suspicious payment infrastructure is rarely static. The same identifiers may reappear across different pages, channels, and campaigns, often with slight variations in formatting or surrounding context. ANTID turns these scattered observations into structured intelligence that can be searched, linked, and reviewed over time.
This makes it possible to answer questions such as:
- Where was a payment detail first seen?
- When was it last observed?
- Which resources exposed it?
- What evidence supports the record?
- Has it appeared in related investigations?
- Is it connected to other suspicious infrastructure?
Important: ANTID is built to transform fragmented public findings into reviewable, evidence-backed intelligence rather than relying on isolated raw observations.
Operational Model
The platform combines automated collection with structured review workflows. Automation increases coverage and speed, while analyst validation improves signal quality and investigative confidence.
In practice, ANTID helps teams move from:
- scattered internet findings
to - normalized payment identifiers
to - verified records with evidence
to - operational intelligence that can support investigations, monitoring, and risk decisions
Best Practices
- Preserve source context for every collected signal
- Normalize extracted values before linking or scoring
- Treat repeated appearances as relationship signals, not duplicates
- Use review statuses to separate raw findings from verified intelligence
- Maintain evidence for each record to support downstream investigations