About & Methodology
Mozo Knowledge Center is the public research arm of Mozo. We publish long-form investigations of the scam and fraud campaigns our platform sees in the wild: email and SMS phishing, social and marketplace fraud, lead-generation schemes, romance and pig-butchering, fake storefronts, and smishing. The work is written for the people who defend against this traffic: detection engineers, SOC analysts, threat researchers, and the reporters who cover them.
About this site
labs.getmozo.com is where our research reaches the security community. Each post is a self-contained investigation of one campaign or operator: how it is built, how it behaves, and the indicators that give it away.
Posts are living documents. When a campaign moves to new infrastructure or changes tactics, we revise the analysis in place and stamp it with a new date instead of leaving a stale snapshot online. Every investigation ships with defanged indicators of compromise. Public posts carry a representative, export-safe subset; the full set goes to vetted researchers through our researcher program.
This is a research resource, not a consumer safety guide. We describe how these operations work in the terms a defender needs to act.
About the research team
The Mozo Research Team works the consumer-fraud beat full time. It is a large, fast-moving beat, and most public coverage of it stays at the surface. What sets our work apart is the pairing of two things that rarely come together: a broad, always-on view of live scam traffic, and analysts who investigate it with the discipline of a threat-intelligence team.
Behind every post is Mozo's detection platform. It ingests and scores content across email, SMS, social advertising, and the open web around the clock, backed by reputation systems that track senders, domains, hosts, and profiles as they age and change. That gives our analysts a vantage point most researchers never get: the same operation seen across several channels at once, from its first appearance through every rotation of its infrastructure. When a campaign surfaces in email, in SMS, and on social in the same day, we can connect the pieces. That corroboration across channels is the strongest signal we have, and most of our attribution starts there.
We do not publish raw machine output. Analysts work the platform's signals, confirm them against primary evidence, and hold every published claim to a standard we can defend in the open. The platform supplies the reach. The analysts supply the confidence.
About our methodology
We map campaigns from the infrastructure up. Instead of stopping at a single reported message, we characterize the operation behind it: the sender conventions, the redirector and hosting backends, the domain-registration cohorts, the subdomain grammar, and the lure and landing-page templates an operator reuses from one victim to the next.
Attribution rests on what an operator does, not on what a registration record claims. Registrant identity is usually privacy-protected and trivial to fake, so we anchor on durable behavior: registration and timing cohorts, shared templates, reused backends, and sending habits that survive even as domains and phone numbers rotate. A pattern that holds across channels and across months is worth more than any single record.
Because we watch these campaigns continuously, our reports run long in time as well as in depth. We follow operators through takedowns, rebrands, and infrastructure churn, and fold each new observation back into the original analysis so the post stays current.
How to read our IOCs
Every indicator on this site is defanged and drawn from an export-safe, analyst-verified tier. Public posts show a representative subset chosen to characterize the campaign; the complete set is reserved for vetted researchers.
hxxp[://]means the protocol is defanged. Do not reactivate it.domain[.]combrackets the dots to prevent linkification.- Indicators inside sample-lure code blocks are verbatim and are never linkified.
The count under each table is a representative floor, not an exact total.
Disclosure & contact
Coordinated-disclosure requests, corrections, and press inquiries go to research@getmozo.com. Corrections to a living document are applied in place and reflected in the post's last-updated date.