Starting point
Observation
What a reporter or investigator actually saw, heard, or received. Keep the original description distinct from later interpretation.
Methodology / A careful sequence
How SpamRecon Investigations Are Organized
A structured way to move from what someone observed to better questions, with the source and limits of each connection kept in view.
Observe→Correlate→Research→Source→Review→Blueprint
Correlation is a research lead, not attribution.
A repeated number, phrase, domain, or route can suggest what to examine next. It does not by itself establish who acted or who was responsible.
DIRECT DETAIL
A reason to look closer
Correlation
A recurring identifier or similarity worth investigating. Record what matched and what did not; a match does not settle identity or control.
Context with provenance
Sourced Research
Information supported by an identified public or authoritative source. Preserve enough source detail for another reviewer to find and assess it.
A possibility, labeled as such
Inference
A possible explanation or relationship that has not been established as fact. State the reasoning and the assumptions it depends on.
An honest boundary
Unresolved Question
Something the available record does not establish. Keep open questions visible instead of filling gaps with guesses.
A structured handoff
Blueprint
A summary of observations, recurrence, sourced research, possible connections, unknowns, and potential record targets for qualified review.
Each relationship should show its source, describe the relationship, and state a caveat. See how that looks in a fictional blueprint example.