Chapter 28: Real-World Case Studies¶

# Investigation begins with corporate registry research

investigation_notes = {
    "step_1": {
        "action": "OpenCorporates search for Westbridge Capital Partners",
        "result": {
            "found": True,
            "registered": "Delaware, 2021-03-15",
            "registered_agent": "National Registered Agents Inc. (generic agent)",
            "officers_listed": "None disclosed (Delaware does not require)",
            "status": "Active"
        },
        "assessment": "Delaware LLC with no disclosure requirements — need other avenues"
    },
    "step_2": {
        "action": "Search for Westbridge Capital Partners in SEC EDGAR",
        "result": {
            "found": False,
            "interpretation": "Not a registered investment advisor or broker-dealer"
        },
        "assessment": "No SEC registration — for a $2.5M investment fund, this warrants explanation"
    },
    "step_3": {
        "action": "Search FINRA BrokerCheck for Alexander Voronov",
        "result": {
            "found": False,
            "interpretation": "Not a registered broker or investment advisor"
        },
        "assessment": "Combination of no SEC/FINRA registration with $2.5M investment offer is a red flag"
    }
}

digital_research = {
    "website": {
        "url": "westbridgecapital.com",
        "whois": {
            "registered": "2021-02-28",  # Two weeks before LLC formation
            "registrar": "Namecheap",
            "privacy": "WhoisGuard protected",
            "hosting": "Cloudflare (masks origin IP)"
        },
        "content_assessment": "Professional-looking website, generic investment language",
        "reverse_image_search": {
            "action": "Reverse image search on team member photos",
            "result": "Alexander Voronov photo matches profile photo of different person on multiple sites"
        }
    },
    "linkedin": {
        "profile_found": True,
        "created": "2021-01",  # Shortly before corporate registration
        "connections": 47,
        "employment_history": "Claims 15 years in private equity, no verifiable companies",
        "activity": "Minimal — 3 posts since account creation",
        "synthetic_indicators": [
            "Low connection count for claimed experience level",
            "Profile photo suspected stolen (reverse image search)",
            "Employment history unverifiable through any public source"
        ]
    },
    "email_analysis": {
        "email_used": "avoronov@westbridgecapital.com",
        "domain_age": "2021-02-28",
        "spf_record": "Present",
        "dmarc": "Not configured — allows spoofing"
    }
}

adverse_research = {
    "news_search": {
        "queries": [
            '"Westbridge Capital" fraud',
            '"Alexander Voronov" investor',
            '"Westbridge Capital Partners" SEC'
        ],
        "results": {
            "Westbridge Capital": "No results",
            "Alexander Voronov": "Results for different Alexander Voronov in different jurisdiction — not same person",
            "SEC": "No enforcement actions found"
        }
    },
    "related_entity_search": {
        "action": "Search for common registered agent address used by similar LLCs",
        "finding": "National Registered Agents Inc. hosts thousands of LLCs — not distinctive",
        "alternative": "Search for other companies with same contact email domain",
        "result": "Domain registered same month as two other 'capital partners' LLCs with similar naming patterns"
    },
    "icij_search": {
        "entities_checked": ["Westbridge Capital Partners", "Alexander Voronov"],
        "result": "No hits in Offshore Leaks Database"
    },
    "opensanctions": {
        "entities_checked": ["Westbridge Capital Partners LLC", "Alexander Voronov"],
        "result": "No hits on Alexander Voronov — the name is common enough that absence is not confirmation of legitimacy"
    }
}

import anthropic

def synthesize_due_diligence(investigation_data: dict) -> str:
    client = anthropic.Anthropic()

    prompt = f"""You are a due diligence analyst reviewing investigation findings about a potential investor.

INVESTIGATION FINDINGS:
{str(investigation_data)}

Provide a structured assessment covering:

1. RED FLAGS: What concerns have been identified?
2. LEGITIMATE INDICATORS: What suggests legitimacy?
3. UNRESOLVED QUESTIONS: What could not be verified?
4. RISK ASSESSMENT: Overall risk rating and reasoning
5. RECOMMENDED NEXT STEPS: What additional verification should be done before accepting funding?

Be direct and evidence-based. Do not soften concerns that warrant serious attention."""

    response = client.messages.create(
        model="claude-sonnet-4-6",
        max_tokens=1500,
        messages=[{"role": "user", "content": prompt}]
    )
    return response.content[0].text

# Synthesized findings in this case:
# - Stolen profile photo is a near-disqualifying red flag
# - No regulatory registration for claimed investment activity
# - Coordinated LLC creation pattern with similar entities
# - All digital presence dates from a single 6-week window in early 2021
# Recommendation: Do not accept funding; refer to law enforcement if investor persists

geolocation_analysis = {
    "sun_analysis": {
        "visible_sun_position": "Ahead and right of vehicle",
        "time_on_dashboard": "14:37",
        "inference": {
            "if_heading_north": "Sun would be ahead-right in northern hemisphere late afternoon",
            "hemisphere_indicator": "Northern hemisphere, late afternoon",
            "approximate_latitude": "40-55 degrees N based on sun elevation angle"
        }
    },

    "vegetation_analysis": {
        "trees_visible": "Deciduous, full foliage",
        "inference": {
            "climate": "Temperate, continental",
            "season": "Late spring to early fall",
            "rules_out": "Tropical, desert, or polar regions"
        }
    },

    "road_markings": {
        "center_line": "Dashed white (not yellow)",
        "edge_line": "White",
        "markings_style": "Consistent with Eastern European road standards",
        "notes": "Yellow center lines common in US/Canada; white in Europe and much of Asia"
    },

    "building_facade": {
        "visible_features": [
            "Stucco exterior finish",
            "Distinctive window pattern — rectangular with central divider",
            "Partial Cyrillic text visible on sign"
        ],
        "inference": "Cyrillic text confirms Eastern European/Eurasian location"
    },

    "vehicle_identification": {
        "vehicles_visible": "Military trucks with visible chassis type",
        "wheel_configuration": "6x6 all-terrain truck",
        "potential_matches": "Multiple former-Soviet truck models",
        "distinctive_marking": "Unit insignia partially visible — requires specialist identification"
    },

    "shadow_analysis": {
        "shadow_direction": "Slightly toward the left of frame",
        "sun_azimuth_estimate": "Roughly 210-230 degrees (SW to WSW)",
        "combined_with_time": {
            "sun_azimuth_sw_at_14:37": "Consistent with latitude ~50-55N in summer"
        }
    }
}

# Reverse image search and geolocation
search_queries = [
    "site:google.com/maps [distinctive building features]",
    "[road markings] [vegetation type] [region claimed]",
    "Yandex reverse image search with still frames"
]

# Cross-reference with claimed location
verification_status = {
    "consistent_with_claimed_location": True,
    "confidence": "MEDIUM",
    "reasons": [
        "Cyrillic text confirmed (consistent with claimed region)",
        "Sun position consistent with claimed date and time at claimed coordinates",
        "Road markings consistent with country of claimed location",
        "Vegetation consistent with season and latitude"
    ],
    "remaining_uncertainty": [
        "Could be anywhere with Cyrillic text and similar terrain",
        "Vehicle type not definitively identified",
        "Date cannot be independently confirmed from video metadata"
    ]
}

import networkx as nx
from datetime import datetime
from collections import Counter
from typing import List, Dict

def analyze_coordination_network(accounts: List[Dict], posts: List[Dict]) -> Dict:
    """
    Analyze accounts for coordinated inauthentic behavior
    """

    G = nx.DiGraph()
    findings = {
        'creation_clustering': {},
        'content_similarity': {},
        'behavioral_patterns': {},
        'network_structure': {},
        'overall_assessment': {}
    }

    # 1. Account creation date analysis
    creation_dates = []
    for account in accounts:
        if account.get('created_at'):
            try:
                date = datetime.fromisoformat(account['created_at'].replace('Z', '+00:00'))
                creation_dates.append(date)
                G.add_node(account['username'], created=date.isoformat())
            except ValueError:
                pass

    if creation_dates:
        creation_dates.sort()
        # Find clusters of accounts created within 7-day windows
        clusters = []
        window = []
        for date in creation_dates:
            if not window or (date - window[0]).days <= 7:
                window.append(date)
            else:
                if len(window) > 2:
                    clusters.append(window)
                window = [date]
        if len(window) > 2:
            clusters.append(window)

        findings['creation_clustering'] = {
            'total_accounts': len(accounts),
            'creation_clusters': len(clusters),
            'clustered_accounts': sum(len(c) for c in clusters),
            'largest_cluster_size': max(len(c) for c in clusters) if clusters else 0,
            'assessment': 'HIGH RISK' if (sum(len(c) for c in clusters) / len(accounts)) > 0.5 else 'MEDIUM'
        }

    # 2. Retweet/amplification network
    for post in posts:
        if post.get('retweeted_from'):
            source = post.get('retweeted_from')
            amplifier = post.get('username')
            if G.has_node(source) and G.has_node(amplifier):
                if G.has_edge(amplifier, source):
                    G[amplifier][source]['weight'] += 1
                else:
                    G.add_edge(amplifier, source, weight=1)

    if len(G.edges()) > 0:
        # Analyze network structure
        density = nx.density(G)
        avg_degree = sum(d for n, d in G.degree()) / len(G)

        # High density in small network = coordinated
        findings['network_structure'] = {
            'nodes': len(G.nodes()),
            'edges': len(G.edges()),
            'density': density,
            'avg_degree': avg_degree,
            'density_assessment': 'HIGH (consistent with coordination)' if density > 0.3 else 'MEDIUM'
        }

        # Find central accounts
        try:
            betweenness = nx.betweenness_centrality(G)
            top_central = sorted(betweenness.items(), key=lambda x: x[1], reverse=True)[:5]
            findings['network_structure']['central_accounts'] = [
                {'account': k, 'centrality': v} for k, v in top_central
            ]
        except Exception:
            pass

    # 3. Posting time analysis — look for human-inconsistent posting patterns
    post_hours = Counter()
    account_post_hours = {}

    for post in posts:
        username = post.get('username')
        posted_at = post.get('posted_at')
        if posted_at:
            try:
                dt = datetime.fromisoformat(posted_at.replace('Z', '+00:00'))
                hour = dt.hour
                post_hours[hour] += 1
                if username not in account_post_hours:
                    account_post_hours[username] = Counter()
                account_post_hours[username][hour] += 1
            except ValueError:
                pass

    # Check for accounts posting at 3-5am (common for bot accounts running on UTC)
    overnight_posters = []
    for username, hours in account_post_hours.items():
        late_night_posts = sum(hours[h] for h in range(2, 6))
        total_posts = sum(hours.values())
        if total_posts > 5 and late_night_posts / total_posts > 0.3:
            overnight_posters.append({
                'account': username,
                'late_night_ratio': late_night_posts / total_posts
            })

    findings['behavioral_patterns'] = {
        'overnight_posting_accounts': overnight_posters,
        'total_accounts_analyzed': len(account_post_hours),
        'assessment': 'SUSPICIOUS' if len(overnight_posters) > 5 else 'NORMAL'
    }

    # 4. Content similarity — find accounts sharing identical or near-identical content
    post_texts = {}
    for post in posts:
        text = post.get('text', '')
        if len(text) > 50:  # Skip very short posts
            username = post.get('username')
            if username not in post_texts:
                post_texts[username] = []
            post_texts[username].append(text[:200])  # First 200 chars

    # Find exact duplicate posts across accounts
    all_texts = []
    for username, texts in post_texts.items():
        for text in texts:
            all_texts.append((username, text))

    text_counter = Counter(text for _, text in all_texts)
    coordinated_posts = [(text, count) for text, count in text_counter.items() if count > 3]

    findings['content_similarity'] = {
        'identical_posts_shared_by_3_plus': len(coordinated_posts),
        'examples': coordinated_posts[:5],
        'assessment': 'HIGH RISK' if len(coordinated_posts) > 5 else 'MEDIUM'
    }

    # Overall assessment
    risk_factors = sum([
        findings['creation_clustering'].get('assessment', '') == 'HIGH RISK',
        findings['behavioral_patterns'].get('assessment', '') == 'SUSPICIOUS',
        findings['content_similarity'].get('assessment', '') == 'HIGH RISK',
        findings.get('network_structure', {}).get('density_assessment', '').startswith('HIGH')
    ])

    findings['overall_assessment'] = {
        'risk_factors_count': risk_factors,
        'coordination_likelihood': 'HIGH' if risk_factors >= 3 else ('MEDIUM' if risk_factors >= 2 else 'LOW'),
        'recommendation': 'Report to platform trust & safety team and document findings' if risk_factors >= 2 else 'Continue monitoring'
    }

    return findings

fraud_investigation = {
    "initial_flags": {
        "transfer_1": {
            "amount": 47500,
            "recipient": "Pacific Rim Consulting Ltd",
            "bank": "SWIFT transfer to Hong Kong correspondent",
            "invoice_description": "Advisory services Q3",
            "matching_po": False
        },
        "transfer_2": {
            "amount": 49800,
            "recipient": "Pacific Rim Consulting Ltd",
            "bank": "Same correspondent bank",
            "invoice_description": "Advisory services Q4",
            "timing": "Two transfers just below $50,000 threshold — structuring indicator"
        }
    },

    "entity_research": {
        "Pacific Rim Consulting Ltd": {
            "hong_kong_registry": {
                "found": True,
                "incorporated": "2022-01-15",
                "address": "Virtual office, shared with 200+ other companies",
                "directors": ["Zhang Wei", "Li Mingzhi"],
                "status": "Active"
            },
            "uk_companies_house": {
                "found": False
            },
            "opencorporates_global": {
                "found": True,
                "notes": "Single entity in HK; no global parent company"
            },
            "web_presence": {
                "website": "Not found",
                "linkedin": "Not found",
                "news": "No results"
            },
            "assessment": "Entity appears to exist solely on paper; no operating presence"
        }
    },

    "transaction_pattern_analysis": {
        "structuring_indicators": [
            "Both transfers just below $50,000 BSA reporting threshold",
            "Same recipient across multiple transfers",
            "No matching purchase orders in ERP system",
            "Invoice dates fall on weekend"
        ],
        "internal_access_indicators": [
            "Transfers authorized by single employee without secondary approval (process violation)",
            "Employee has access to both AP system and banking portal"
        ]
    },

    "director_research": {
        "Zhang Wei": {
            "note": "Extremely common name — difficult to research without additional identifiers",
            "action": "Request from HK registry for director details including ID number"
        },
        "Li Mingzhi": {
            "opencorporates_officers": "Appears as director in 14 other HK companies, 12 incorporated in 2021-2022",
            "assessment": "Serial director profile — common in nominee director services"
        }
    },

    "recommendation": {
        "immediate_actions": [
            "Preserve all financial records and communications",
            "Do not alert the authorizing employee",
            "Engage forensic accounting firm",
            "Refer to law enforcement for potential SAR filing"
        ],
        "osint_findings_summary": "Recipient entity shows classic characteristics of a shell company used for fraudulent billing: virtual office address, nominee directors, no public operating presence, recently incorporated, no web footprint, and transaction structuring pattern consistent with BSA avoidance"
    }
}