Phase 8 · Timeline reconstruction
§ 8 · Chronological intelligence

Timeline reconstruction · demo.subject@example.com

Public-source events, ordered chronologically. Mixes hard evidence (breach drops, archive snapshots) with cadence inferences. Every entry traces back to its source.

  1. 2014-08-12 · platform joininfo

    First public platform registration

    Account creation traces emerge in archive snapshots, suggesting initial public surface formation.

    archive layer · platform_join inference
  2. 2016-04-21 · breachhigh

    Identity surfaces in historical breach corpus

    Email co-located with 47M-record drop; password rotation strongly recommended (if not already).

    HIBP-aligned dataset · 2017 spring drop
  3. 2018-11-03 · platform joinelevated

    Cross-platform alias linkage detected

    Same handle pattern resolves on 6 distinct platforms within a 3-week window.

    maigret · sherlock
  4. 2021-06-14 · post burstnotable

    Posting cadence spike

    Engagement velocity ~3x baseline for ~12 days; pattern consistent with a campaign or event.

    open social index
  5. 2023-02-08 · archiveinfo

    Archive layer snapshot

    Profile metadata captured in the Wayback Machine; useful for historical comparison.

    web.archive.org
  6. 2025-09-22 · public mentionhigh

    Breach Exposure

    3 historical breaches detected · LinkedIn (2021) · Adobe (2013) · Dropbox (2012)

    HIBP-aligned breach corpus
  7. 2025-09-22 · public mentionelevated

    Linked Platforms

    Account presence confirmed on 11 platforms · Twitter · Spotify · Pinterest · Patreon · 7 more

    Holehe + open platform registry
  8. 2025-09-22 · public mentionelevated

    Username Reuse

    Reused alias detected: "demox" across 6 platforms

    Maigret cross-platform sweep
  9. 2026-05-05 · profile changenotable

    Recent profile-metadata mutation

    Display name or avatar changed within the last fortnight; new state cached.

    continuous monitoring