The Supplement SMS Kit That Borrows Real Business Identities
Since April 2026, one operation has run 26 supplement storefront domains by text message, most carrying the legal identity of a real registered business.
Latest research
How a Government-Impersonation Smishing Kit Signs Its Own Registration Batches
A smishing kit impersonating toll agencies, tax offices and national police stamped the registration date into its own WHOIS records.
One Lure, Four Operators: Ad Tracking Strings as Fingerprints
Four separate operators ran the same fake TradingView desktop-app ads on Facebook for nine months, and one query-string key was all that told them apart.
Rented Storefronts: A Fake-Store Franchise on Facebook Ads
Across 2026 we mapped 100+ fraudulent storefronts fronted by disposable Facebook advertisers, increasingly hosted as tenants on legitimate builder platforms.
Eleven Buying Teams, One Shared Crypto Lander Pool
Between November 2025 and August 2026, eleven media-buying teams ran crypto brand-impersonation ads out of one shared pool of burner domains.
A Deposit That Was Never Coming: Inside a 56-Domain Lead-Gen Estate
An email from a bank you have never heard of says a deposit is pending. Behind it sit 56 domains, one hosting account, and a single affiliate offer.
One Mailbox, 178 Brand Costumes: Anatomy of a Consumer-Data Lead Broker
Between January and June 2026, a single email operator sent US consumers offers under 178 different sender names, 118 of them belonging to real companies.