Real-time threat intelligence, active investigations, and takedown operations from our detection systems.
Investigations, research, and takedown operations
IANA #4318. €120 declared annual revenue. 1 employee. Negative equity. Deletion notice published. Two Belarusian owners. Six fake crypto casinos registered in a single week — one calling itself “Elon Musk’s Official Casino” — all hidden behind Trustname’s own offshore privacy proxies. The registrar literally calls itself bulletproof in its own DNS TXT record.
Extract complete message history, identify users with account age estimation, detect stolen credentials, credit cards, crypto wallets, seed phrases and API keys. Branded intelligence reports with interactive charts.
How crypto scammers exploit Yahoo SERP injection and PBN networks to rank phishing sites #1 on Bing and DuckDuckGo, stealing millions from search users.
A 10-year, $2M+ Monero theft operation — finally destroyed. Three registrars suspended the domains. NameSilo fabricated a cover story, called the scammer “the victim,” and helped suppress VirusTotal alerts. We proved 7 lies, filed with ICANN and law enforcement. The domain is dead. The registrar’s reputation should be too.
16 antivirus detections. 13 reports. 1,788 hours online. Real data from our abuse escalation log shows registrars ignoring evidence-packed reports while phishing domains stay active for months. Who in their abuse department overrules Kaspersky, ESET, and Fortinet?
A fake military aid foundation targeting Ukrainian veterans. 5 banks cloned with real-time operator control. One misconfigured file on a shared server exposed the entire operation — operators identified via 6 Telegram API calls. Full behavioral analysis of 261 messages reveals a cross-border criminal enterprise.
We intercepted live phishing traffic, reverse-engineered 8 seed phrase stealers, and traced data to Telegram bots, EmailJS, FormSubmit, custom C2 APIs, and PhaaS backends. 1,824+ stolen credentials. Total attacker cost: $0.
Full takedown of a Russian-speaking scam operation running a fake Trust Wallet support panel with live chat, staking simulation, and multi-operator support. 1,900 victim sessions dumped via IDOR, 21 scammer wallets tracked, primary actor deanonymized.
4 live scam backends analyzed — Firebase with open Firestore rules, Supabase with full CRUD access, Express.js with zero auth, and a 19K-seed drainer campaign. All trivially deanonymizable.
Full infrastructure teardown: 55+ phishing domains, unauthenticated APIs leaking victim data, on-chain drainer contracts, Google Ads funding, and Chinese-language operators exposed.
Forensic investigation: Monero web wallet leaks your private view key 40+ times per session via Base64 session tokens, then nullifies your transaction with raw_tx = 0. Operator identified.
How scammers use cloaking, white pages, and TDS systems to hide phishing from security scanners while targeting real victims. 50,000+ sites analyzed.
50,000+ sites scanned, 1,565 admin panels discovered, 0% legitimate use rate. Criminal clients include EvilCorp, LockBit, and VexTrio. Open-source detection tools released.
The "middle class" of fraud exposed. Three teams, shared Google Spreadsheets, and proof that OSINT disruption works — 717Team archived after intelligence operations.
Not a scam tool — a scam university. $10M+ claimed, 5,000+ members trained since 2021. 730+ scammer usernames leaked. The upstream producer behind casino and drainer operations.
Analyze domains, check wallets, scan URLs — all free, no registration.
