Two hip-hop artists, Dwake and Present, are in the middle of a feud. After long-stewing tensions, Dwake struck first with a diss track. Present's label hired someone to retaliate.
Your homeboy in the cyber underground passed along a tip. Someone at IP 18.66.52.227 was poking around OWL Records' website in early April. You're the security analyst. Pull the traffic.
Four rows. Someone really was in there, clicking around your website.
Look at what they were searching. They hit Dwake's profile. They pulled his email. But look at the search queries and you'll see the operator has opinions. Strong ones. They couldn't help typing them into the search bar.
There's one row in particular.
Right. The operator was wondering why Dwake's music is so trasshhhh. They typed it into your search bar. Hackers have opinions too, apparently.
But this wasn't just petty. Go back to Dwake's verse.
To reset a password at OWL Records you answer two security questions: mother's maiden name and childhood pet's name. Dwake rapped both answers on the record.
Scroll to the bottom of the results. The operator used those exact words.
You caught it.
The password-reset URL contains answer_1=Washington and answer_2=Fluffy. Dwake phished himself on his own diss track.
That's the whole KC7 habit: the evidence is always in the data, the data always tells a story, and once you see it, you can't unsee it. The full case has thirty more questions like this.
 - Recording mic.png)
