[
  {
    "id": "SA-038",
    "slug": "cloned-voice-ceo-transfer-fideuram",
    "title": "A message from the CEO. A call from the lawyer. Neither was real.",
    "short_title": "The €95 million cloned-voice transfer",
    "category": "Banking",
    "technique": "Executive impersonation with an AI-cloned voice",
    "kind": "incident",
    "audience": "Executives, treasury and finance teams, and anyone who can authorise a payment on someone else's instruction",
    "subject": "Fideuram (Intesa Sanpaolo group) transfer fraud, February 2026",
    "summary": "According to Reuters, fraudsters posing as Intesa Sanpaolo's chief executive on WhatsApp, then as a law-firm partner on a call with an AI-cloned voice, got the chairman of its private-banking arm Fideuram to order about €95 million in transfers abroad. About €36 million is still missing.",
    "lesson": "Seniority and a familiar voice are not authorisation. An urgent, confidential transfer request must be confirmed by calling the person back on a number you already hold, and pass the normal dual-approval process, however senior the requester and however convincing the second voice that 'confirms' it.",
    "claim": "The CEO's urgent, confidential transfer",
    "counterclaim": "Call back on a number you already hold",
    "observations": [
      "The first contact came through WhatsApp, a channel outside the bank's own systems, from someone presenting as the group's chief executive.",
      "The request carried the classic pressure of CEO fraud: urgent help with an overseas transaction.",
      "A second, apparently independent party then 'confirmed' the instruction by phone: a caller presenting as a senior partner at a prominent law firm, whose voice Reuters says was replicated with AI.",
      "The victim was himself a senior executive, and the order went through his own finance department: authority inside the organisation carried the fraud past the usual checks.",
      "The money went mainly to accounts in China and Hong Kong and, according to Reuters, part of it was converted into cryptocurrency."
    ],
    "source_summary": "Reuters reported on 25 September 2026, citing sources, that the fraud began in February 2026, when the then-chairman of Fideuram received a WhatsApp message that appeared to come from Intesa Sanpaolo's CEO asking for urgent help with an overseas transaction, followed by a call from someone posing as a senior partner at a prominent law firm, whose voice was replicated with AI. He instructed the finance department to make a series of transfers, mainly to China and Hong Kong, totalling about €95 million. About €53 million was recovered through cooperation between authorities in China, Portugal and Italy; about €36 million has not been traced after passing through overseas accounts and being converted into cryptocurrency. Milan prosecutors have placed a foreign national living outside Europe under investigation for computer fraud; no Fideuram executive is under investigation. The chairman resigned in March 2026 citing personal reasons. Intesa Sanpaolo and Fideuram declined to comment. Il Sole 24 Ore separately reports the same amounts (€40 million recovered from a Chinese bank and €13 million from a Portuguese one) and the use of AI to replicate the lawyer's voice.",
    "limits": "This case rests on press reports based on unnamed sources; Intesa Sanpaolo and Fideuram declined to comment, and no court has ruled. The AI voice cloning is as described by the reporting, not verified here, and neither source publishes the messages or the recording. It is not established how the voice sample was obtained or whether other institutions were targeted. Nothing here suggests that the executives impersonated were involved; they were the identities the fraudsters borrowed.",
    "analysis_date": "2026-09-25",
    "checked_at": "2026-09-29",
    "assessment": "Documented fraud · press reporting from unnamed sources",
    "assessment_source": "Reuters; Il Sole 24 Ore",
    "sources": [
      {
        "name": "Reuters (as republished by Global Banking & Finance Review)",
        "short": "Reuters",
        "role": "Original report, citing sources, on the scam, the amounts and the investigation · 25 September 2026",
        "url": "https://www.globalbankingandfinance.com/ai-messaging-scam-costs-italys-top-bank-intesa-millions/"
      },
      {
        "name": "Il Sole 24 Ore",
        "short": "Il Sole 24 Ore",
        "role": "Separate report on the recovered amounts and the cloned voice · September 2026",
        "url": "https://en.ilsole24ore.com/art/the-former-boss-of-fideuram-was-scammed-via-whatsapp-and-36-million-have-gone-missing-AJXuauOB"
      }
    ],
    "pathway": {
      "heading": "How a borrowed voice can move a bank's money",
      "intro": "The fraud used real authority twice: a chief executive's name to create urgency, and a lawyer's cloned voice to confirm it. The control point is a call-back you start yourself.",
      "steps": [
        {
          "label": "IMPERSONATE",
          "title": "A message 'from the CEO'",
          "text": "A WhatsApp message asks for urgent help with a confidential overseas transaction."
        },
        {
          "label": "CONFIRM",
          "title": "A cloned voice 'confirms'",
          "text": "A call from a supposed law-firm partner, with an AI-replicated voice, backs up the instruction. Call back on a known number instead.",
          "warning": true
        },
        {
          "label": "TRANSFER",
          "title": "The money leaves",
          "text": "Transfers to accounts in China and Hong Kong; part is converted into cryptocurrency."
        }
      ],
      "caption": "Documented public incident, as reported by the press. No message, recording or private record is reproduced here."
    }
  },
  {
    "id": "SA-037",
    "slug": "phishing-that-knows-your-trip",
    "title": "It knows the train you took. That is what makes it dangerous.",
    "short_title": "The phishing that knows your trip",
    "category": "Transport",
    "technique": "Breach-fed personalisation",
    "kind": "emerging",
    "subject": "Renfe and Adif data breach, 2026",
    "summary": "A leak that links passengers to real journeys could let fraudsters write refund or booking messages that mention trips you actually made. No such attack has been reported yet.",
    "lesson": "A message that knows real details of your life is not proof that it is genuine. Leaked data can supply those details. Check any refund or booking incident by opening the operator's app or website yourself, never through the link or number in the message.",
    "message": "Hello [your name], we are contacting you about your journey Madrid – Valencia on 14 September, seat 7C. Due to the service incident on that route you are entitled to a €38.40 refund. To receive it, confirm your details and your card within 24 hours: [link]",
    "claim": "Your 14 September trip: €38.40 refund",
    "counterclaim": "Real trip details, from leaked data",
    "observations": [
      "The attacker opens with facts the victim recognises: their name, a real route and date, perhaps a seat.",
      "The pretext fits the travel: a refund for a disrupted journey, or an incident with a booking.",
      "Familiar details lower suspicion, so the request for card or identity data at the end feels routine.",
      "Unlike generic phishing, each message can be different and personal, which makes it harder to recognise as a campaign."
    ],
    "source_summary": "Xataka, drawing on an El Mundo analysis confirmed by Adif, reports that a cyberattack on Adif reached interconnected Renfe systems and exposed about 500 GB and over 150 million records: identity data (names, national ID numbers, phone numbers, emails, dates of birth, postal addresses) and about 100 million nominative ticket records that can be cross-referenced to reconstruct passengers' travel. The article itself warns that an attacker could use this to write credible messages about a supposed ticket refund or a booking incident. It states that bank and payment data were not compromised.",
    "limits": "This is an anticipated scenario, not a documented case: there is no known case of this fraud yet. The message is invented by the observatory for illustration; its route, date, seat and amount are fictional, and it does not reproduce any real message or any real person's data. The breach figures are those reported by the cited source and are not independently verified here. Nothing here suggests that Renfe or Adif send such messages.",
    "analysis_date": null,
    "checked_at": "2026-09-28",
    "assessment": "Emerging threat · possible, not yet observed",
    "assessment_source": "Digital Fraud Observatory, from Xataka reporting",
    "sources": [
      {
        "name": "Xataka",
        "short": "Xataka",
        "role": "Reporting on the scope of the Renfe and Adif breach and its phishing risk · 28 September 2026",
        "url": "https://www.xataka.com/seguridad/creiamos-que-hackeo-renfe-habia-expuesto-correos-nombres-eso-solo-era-punta-iceberg"
      }
    ],
    "audience": "Rail passengers in Spain, and anyone whose travel records have leaked",
    "es": {
      "title": "Sabe qué tren cogiste. Eso es lo que lo hace peligroso.",
      "short_title": "El phishing que conoce tu viaje",
      "category": "Transporte",
      "technique": "Personalización con datos filtrados",
      "subject": "Filtración de datos de Renfe y Adif, 2026",
      "summary": "Una filtración que vincula a los pasajeros con viajes reales permitiría a los estafadores escribir mensajes sobre devoluciones o reservas que mencionan trayectos que de verdad hiciste. De momento no hay constancia de ningún ataque así.",
      "lesson": "Que un mensaje conozca detalles reales de tu vida no demuestra que sea auténtico: los datos filtrados pueden aportar esos detalles. Comprueba cualquier devolución o incidencia con una reserva entrando tú mismo en la app o la web del operador, nunca a través del enlace o el teléfono del mensaje.",
      "message": "Hola [tu nombre], te escribimos por tu viaje Madrid – Valencia del 14 de septiembre, plaza 7C. Por la incidencia en el servicio de esa ruta tienes derecho a un reembolso de 38,40 €. Para recibirlo, confirma tus datos y tu tarjeta en las próximas 24 horas: [enlace]",
      "claim": "Tu viaje del 14 de septiembre: reembolso de 38,40 €",
      "counterclaim": "Datos reales del viaje, sacados de una filtración",
      "observations": [
        "El atacante empieza con datos que la víctima reconoce: su nombre, una ruta y una fecha reales, quizá hasta la plaza.",
        "El pretexto encaja con el viaje: el reembolso de un trayecto con incidencias, o un problema con una reserva.",
        "Los detalles conocidos bajan la guardia, y la petición final de la tarjeta o de datos personales parece un trámite.",
        "A diferencia del phishing genérico, cada mensaje puede ser distinto y personal, lo que hace más difícil reconocerlo como una campaña."
      ],
      "source_summary": "Xataka, a partir de un análisis de El Mundo confirmado por Adif, informa de que un ciberataque contra Adif alcanzó sistemas interconectados de Renfe y expuso unos 500 GB y más de 150 millones de registros: datos de identidad (nombres, DNI, teléfonos, correos electrónicos, fechas de nacimiento, direcciones postales) y unos 100 millones de registros de billetes nominativos que pueden cruzarse para reconstruir los viajes de los pasajeros. El propio artículo advierte de que un atacante podría usarlo para escribir mensajes creíbles sobre una supuesta devolución de un billete o una incidencia con una reserva. Según el artículo, los datos bancarios y de pago no se vieron comprometidos.",
      "limits": "Es un escenario anticipado, no un caso documentado: todavía no hay constancia de este fraude. El mensaje lo ha escrito el observatorio como ilustración; la ruta, la fecha, la plaza y el importe son ficticios, y no reproduce ningún mensaje real ni datos de ninguna persona real. Las cifras de la filtración son las que publica la fuente citada y no se han verificado de forma independiente aquí. Nada de lo que aquí se dice indica que Renfe o Adif envíen mensajes así.",
      "assessment": "Amenaza emergente · posible, aún no observada",
      "assessment_source": "Digital Fraud Observatory, a partir de lo publicado por Xataka",
      "audience": "Viajeros de tren en España y cualquier persona cuyos datos de viaje se hayan filtrado",
      "sources": [
        {
          "name": "Xataka",
          "short": "Xataka",
          "role": "Información sobre el alcance de la filtración de Renfe y Adif y su riesgo de phishing · 28 de septiembre de 2026",
          "url": "https://www.xataka.com/seguridad/creiamos-que-hackeo-renfe-habia-expuesto-correos-nombres-eso-solo-era-punta-iceberg"
        }
      ]
    }
  },
  {
    "id": "SA-004",
    "slug": "insurance-clone",
    "title": "A regulatory badge. A very different reality.",
    "short_title": "The insurance clone",
    "category": "Insurance",
    "technique": "Borrowed authority",
    "kind": "capture",
    "subject": "speedysure.co.uk",
    "summary": "An insurance site claims FCA regulation. The regulator identifies it as a clone firm.",
    "lesson": "Verify a regulatory claim with the regulator, using contact details from its official register.",
    "image": "insurance-clone.png",
    "image_source": "https://desenmascara.me/screens/d546934417842385.png",
    "image_alt": "Archived SpeedySure website offering car insurance from £4.50 an hour and claiming FCA regulation.",
    "claim": "FCA Regulated",
    "counterclaim": "Clone of an authorised firm",
    "observations": [
      "A prominent badge claims FCA regulation.",
      "A low hourly price, customer count and instant-quote buttons encourage registration.",
      "The capture presents the service as an established insurance provider."
    ],
    "source_summary": "The FCA names SpeedySure and speedysure.co.uk in a clone-firm warning. Desenmascara separately records a Suspicious assessment of 60/100 in report #11454.",
    "limits": "The image is a historical capture; its exact capture date is not established here. The source assessments are attributed separately. The screenshot does not establish AI use or customer losses. The genuine firm named by the FCA is separate from the clone.",
    "analysis_date": "2026-09-13",
    "checked_at": "2026-09-14",
    "assessment": "Suspicious · 60/100",
    "assessment_source": "desenmascara.me",
    "sources": [
      {
        "name": "Financial Conduct Authority",
        "short": "FCA",
        "role": "Independent clone-firm warning · 2 February 2026",
        "url": "https://www.fca.org.uk/news/warnings/speedysure-clone-fca-authorised-firm"
      },
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report #11454 and archived capture",
        "url": "https://desenmascara.me/analisis/60ffed47-2000-40f5-add7-6afa08f66085"
      }
    ],
    "audience": "Consumers buying insurance online"
  },
  {
    "id": "SA-005",
    "slug": "logistics-company-facade",
    "title": "A global operation. An identity still to verify.",
    "short_title": "The logistics-company facade",
    "category": "Transport",
    "technique": "Manufactured credibility",
    "kind": "capture",
    "subject": "folonicalogistics.com",
    "summary": "A cargo-port image, certification claim and parcel tracker present the appearance of an established carrier.",
    "lesson": "A transport website does not establish that a carrier exists. Verify the company identity and any certification through independent records before entrusting it with money or goods.",
    "image": "logistics-company-facade.png",
    "image_source": "https://desenmascara.me/screens/7057c6989c40fc48.png",
    "image_alt": "Archived Folanica-branded logistics page with container ships, port cranes, a certification claim and yellow Track Parcel buttons.",
    "claim": "Certified intermodal logistics",
    "counterclaim": "Who certified this operator?",
    "observations": [
      "A large photograph of container ships and port cranes suggests an international shipping operation.",
      "A certification badge makes an authority claim without identifying a certifier in this captured view.",
      "Parcel-tracking buttons and service navigation make the page look operational; the image cannot show whether those services work."
    ],
    "source_summary": "Desenmascara report #152096 records a Fraudulent assessment of 95/100, attributed to a PhishDestroy DestroyList match. Its accompanying analysis says the operator’s legal identity could not be verified and flags a recently registered domain.",
    "limits": "This is a suspected ghost-company facade, not an independent finding that no registered company exists. The historical capture does not establish ownership of the pictured ships, a working tracking system, customer losses or a payment demand. Its capture date is unknown. The report also labels text as AI-generated, but that automated attribution is not proof of authorship. Shared hosting or a young domain alone does not prove fraud.",
    "analysis_date": "2026-08-20",
    "checked_at": "2026-09-14",
    "assessment": "Fraudulent · 95/100",
    "assessment_source": "desenmascara.me · attributed PhishDestroy feed match",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report #152096 and archived capture; cites PhishDestroy as the verdict source",
        "url": "https://desenmascara.me/analisis/a59f7ad1-cace-4ed1-98e6-6e27a7b78615"
      }
    ],
    "audience": "Customers, shippers and business counterparties"
  },
  {
    "id": "SA-002",
    "slug": "celebrity-casino",
    "title": "A famous face. An unverified promise.",
    "short_title": "The celebrity casino",
    "category": "Crypto",
    "technique": "Celebrity impersonation",
    "kind": "capture",
    "subject": "Sanewex · domain partially masked in source",
    "summary": "Celebrity imagery and supposed official partnerships make a crypto casino look credible.",
    "lesson": "A famous face or familiar logo is a website’s claim. Check endorsements through the supposed partner’s own channels.",
    "image": "celebrity-casino.png",
    "image_source": "https://desenmascara.me/screens/f667d92e6e6f9130.png",
    "image_alt": "Archived Sanewex casino page displaying Elon Musk and X and SpaceX partnership claims.",
    "claim": "Official partner",
    "counterclaim": "Endorsement not verified",
    "observations": [
      "Elon Musk’s image appears beside a claim that he backs the casino.",
      "X and SpaceX branding is labeled as an official partnership.",
      "A bonus invitation sits alongside large player and payout figures."
    ],
    "source_summary": "Desenmascara classifies the page as a crypto gambling scam involving celebrity impersonation. Its rationale cites unverified partnership claims and no visible legitimate licensing information.",
    "limits": "This is Desenmascara’s recorded assessment, not a new investigation. The screenshot does not establish that AI created the page or images, or that the displayed payout figures are real. Follow the original report for context and corrections.",
    "analysis_date": "2026-08-21",
    "checked_at": "2026-09-14",
    "assessment": "Fraudulent · 81/100",
    "assessment_source": "desenmascara.me",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report #88469 and archived capture",
        "url": "https://desenmascara.me/analisis/090b5a46-d486-4065-8790-aa5b59f0b725?src=gallery"
      }
    ],
    "audience": "Crypto gamblers and retail investors"
  },
  {
    "id": "SA-001",
    "slug": "pay-to-get-paid",
    "title": "Your earnings are ready. First, send money.",
    "short_title": "The task-payment trap",
    "category": "Jobs",
    "technique": "Advance-fee request",
    "kind": "reconstruction",
    "subject": "Task scam pattern",
    "summary": "A supposed job shows earnings, then demands a deposit before you can withdraw them.",
    "lesson": "A number on a dashboard does not prove that withdrawable earnings exist. Do not send money to release supposed wages.",
    "message": "Great work! Your task balance is now €184. To withdraw it, top up your account with €60 to complete the final task set. The deposit will be returned with your earnings.",
    "claim": "€184 ready to withdraw",
    "counterclaim": "€60 deposit requested first",
    "observations": [
      "An apparent job offers commissions for simple online tasks.",
      "A displayed balance makes the earnings feel real.",
      "A separate payment is demanded before those supposed earnings can be withdrawn."
    ],
    "source_summary": "FTC guidance describes task scams in which an online platform displays apparent commissions, then asks the person to deposit their own money. The message here is an educational reconstruction of that pattern.",
    "limits": "The wording and amounts are invented. This is not a victim’s message or an accusation against a named business. A legitimate payout minimum is different from asking someone to send a separate deposit. AI involvement is not established.",
    "analysis_date": null,
    "checked_at": "2026-09-14",
    "assessment": "Documented pattern · fictional message",
    "assessment_source": "FTC guidance",
    "sources": [
      {
        "name": "Federal Trade Commission",
        "short": "FTC",
        "role": "Consumer advisory documenting task scams",
        "url": "https://consumer.ftc.gov/consumer-alerts/2024/11/task-scams-create-illusion-making-money"
      },
      {
        "name": "Federal Trade Commission",
        "short": "FTC",
        "role": "Task-scam analysis and reporting context",
        "url": "https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2024/12/paying-get-paid-gamified-job-scams-drive-record-losses"
      }
    ],
    "audience": "Job seekers and online task workers"
  },
  {
    "id": "SA-003",
    "slug": "discount-store",
    "title": "A big discount is a reason to check.",
    "short_title": "The discount storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "alwaysondeals.com",
    "summary": "An ordinary-looking shop promotes substantial discounts. The source flags a fake-store risk.",
    "lesson": "Check who operates a shop before trusting its sale. A discount alone proves neither fraud nor legitimacy.",
    "image": "discount-store.png",
    "image_source": "https://desenmascara.me/screens/d511479ddacafb4a.png",
    "image_alt": "Archived ALWAYS storefront with a Spanish sales banner and discounts of up to 75–80%.",
    "claim": "Large discounts and daily offers",
    "counterclaim": "Seller legitimacy needs checking",
    "observations": [
      "A Spanish storefront advertises large discounts and daily offers.",
      "Cart and account controls make the page look like a conventional shop.",
      "The screenshot does not identify who ultimately receives a buyer’s payment."
    ],
    "source_summary": "Desenmascara classifies it as a fake store, citing unusually high discounts, unclear brand legitimacy and hosting associations.",
    "limits": "Shared hosting is not proof of common ownership or fraud. The screenshot cannot establish non-delivery, stolen payments or AI-generated content. The classification belongs to the source; this card adds no independent verdict.",
    "analysis_date": "2026-02-10",
    "checked_at": "2026-09-14",
    "assessment": "Fraudulent · 75/100",
    "assessment_source": "desenmascara.me",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report #11604 and archived capture",
        "url": "https://desenmascara.me/analisis/dbe93ad9-fb73-47ca-8d2d-71a20f232e07"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-006",
    "slug": "investment-platform",
    "title": "A trading dashboard. A promise built on urgency.",
    "short_title": "The investment platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "spakasprimetrade.com",
    "summary": "A trading platform presents crypto and CFD investing as an easy route to returns.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "investment-platform.png",
    "image_source": "https://desenmascara.me/screens/12284042129701e8.png",
    "image_alt": "Archived Spakas Prime Trade investment platform presenting crypto and CFD trading claims.",
    "claim": "Professional trading platform",
    "counterclaim": "Investment firm and licensing need independent verification",
    "observations": [
      "The page presents a polished trading service with crypto and investment language.",
      "A young domain and unclear corporate identity increase the need for independent checks.",
      "The screenshot cannot establish whether funds were accepted or returned."
    ],
    "source_summary": "Desenmascara records a Fraudulent assessment for spakasprimetrade.com. The assessment describes a CFD trading platform using bitcoin and crypto language, a young domain and an unclear registrar identity, and labels the pattern investment fraud.",
    "limits": "This is a dated capture and an attributed source assessment, not a new investigation by this project. The image does not prove customer losses, the identity of an operator or that every crypto investment offer is fraudulent. Check current regulator records and the original report for updates.",
    "analysis_date": "2026-09-14",
    "checked_at": "2026-09-14",
    "assessment": "Fraudulent · source assessment",
    "assessment_source": "desenmascara.me",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture",
        "url": "https://desenmascara.me/analisis/549ed147-9c7e-429c-977f-69b31f8e0eba"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-007",
    "slug": "revolut-government-request-impersonation",
    "title": "A lawful-looking request. A disclosure to the wrong party.",
    "short_title": "The Revolut request impersonation",
    "category": "Financial data",
    "technique": "Government-request impersonation",
    "kind": "incident",
    "audience": "Banks, fintechs, legal and compliance teams; affected customers as data subjects",
    "subject": "Revolut customer-data disclosure after fraudulent government-domain requests",
    "summary": "Revolut confirmed that sensitive customer data was disclosed after fraudulent information requests were sent from a legitimate government-agency email domain.",
    "lesson": "For regulated firms, a trusted domain is not enough. Sensitive data requests need independent requester verification, authority checks and escalation paths before records leave the institution.",
    "claim": "Official information request",
    "counterclaim": "Requester authority must be independently verified",
    "observations": [
      "The reported attack targeted a compliance workflow rather than a public scam landing page.",
      "Revolut told TechCrunch the requests came from a legitimate government-agency email domain and were fraudulent.",
      "Reportedly exposed data included identity and contact details, identity-document copies, and possibly selfies, statements and transaction histories.",
      "Revolut said its systems and customer funds were unaffected, while affected customers were contacted directly."
    ],
    "source_summary": "TechCrunch reported on 12 September 2026 that Revolut confirmed a limited number of customers were impacted after fraudulent information requests were sent from a legitimate government-agency email domain. The Block separately reported that the incident involved KYC and account data, with possible Bitcoin transaction history exposure. The Financial Times later reported that nearly 700 customers were affected and that the UK Information Commissioner's Office had opened an investigation.",
    "limits": "This case is based on public reporting and Revolut statements quoted by those outlets. The government agency, exact request documents, affected markets and final regulator findings were not publicly established in these sources. The incident should not be described as customer funds being stolen or Revolut's core systems being compromised unless later evidence supports that.",
    "analysis_date": "2026-09-12",
    "checked_at": "2026-09-15",
    "assessment": "Confirmed data exposure · public reporting",
    "assessment_source": "TechCrunch, The Block and Financial Times",
    "sources": [
      {
        "name": "TechCrunch",
        "short": "TechCrunch",
        "role": "Initial report with Revolut confirmation · 12 September 2026",
        "url": "https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/"
      },
      {
        "name": "The Block",
        "short": "The Block",
        "role": "Follow-up report on KYC and transaction data exposure · 12 September 2026",
        "url": "https://www.theblock.co/news/business/2026-09-12-revolut-says-customer-kyc-bitcoin-transaction-data-exposed-after-fake-request-from-govt-domain-414516"
      },
      {
        "name": "Financial Times",
        "short": "FT",
        "role": "Follow-up reporting on affected-customer count and ICO investigation · 15 September 2026",
        "url": "https://www.ft.com/content/e0fe28a8-bc8c-460d-a7f2-972f725c0d46"
      }
    ],
    "pathway": {
      "heading": "How a trusted request can become a data disclosure",
      "intro": "Each step can look routine. The control point is independent verification before sensitive records are released.",
      "steps": [
        {
          "label": "REQUEST",
          "title": "Official-looking request",
          "text": "The request appears to come through a legitimate government channel."
        },
        {
          "label": "VERIFY",
          "title": "Verify the requester",
          "text": "Confirm identity, legal authority and scope through an independent route.",
          "warning": true
        },
        {
          "label": "DISCLOSE",
          "title": "Disclosure risk",
          "text": "Sensitive customer records can leave through a normal compliance process."
        }
      ],
      "caption": "Documented public incident. No live system or private customer record is embedded here."
    }
  },
  {
    "id": "SA-010",
    "slug": "nobletechglobalinvesting-com",
    "title": "Crypto earnings, on a site nobody stands behind.",
    "short_title": "The wallet lure",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "nobletechglobalinvesting.com",
    "summary": "Desenmascara flagged nobletechglobalinvesting.com as fraudulent (100/100). The site presented itself as a crypto platform.",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "nobletechglobalinvesting-com.png",
    "image_source": "https://desenmascara.me/screens/d51b7f1befec67b1.png",
    "image_alt": "Archived capture of nobletechglobalinvesting.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "Promises returns that are unrealistic or guaranteed.",
      "Social media icons do not lead to real profiles.",
      "The domain was only 124 days old when analysed.",
      "The source report records: hosted on an address where 135 of 199 domains we have analysed are flagged (68%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for nobletechglobalinvesting.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-03",
    "checked_at": "2026-09-15",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/e7fa0168-0a43-4954-bbbd-876377aa5584"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-05-02 through Web4Africa Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=nobletechglobalinvesting.com"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-011",
    "slug": "global-freightltd-com",
    "title": "Cargo, tracking, a fleet: all claims, no carrier.",
    "short_title": "The freight company",
    "category": "Transport",
    "technique": "Manufactured credibility",
    "kind": "capture",
    "subject": "global-freightltd.com",
    "summary": "An archived look at global-freightltd.com, a logistics carrier assessed as fraudulent by Desenmascara (AI-assisted analysis, 99/100).",
    "lesson": "A transport website does not establish that a carrier exists. Verify the company identity before entrusting it with money or goods.",
    "image": "global-freightltd-com.png",
    "image_source": "https://desenmascara.me/screens/64507388f9c6be55.png",
    "image_alt": "Archived capture of global-freightltd.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Does this carrier exist outside its website?",
    "observations": [
      "Social media icons do not lead to real profiles.",
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 135 of 199 domains we have analysed are flagged (68%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 99/100 for global-freightltd.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-12",
    "checked_at": "2026-09-15",
    "assessment": "Fraudulent · 99/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/c4d5dc27-975f-499e-9d07-89f15b3c733b"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2025-11-02 through Global Domain Group LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=global-freightltd.com"
      }
    ],
    "audience": "Customers, shippers and business counterparties"
  },
  {
    "id": "SA-012",
    "slug": "cashclaimagilitybank-com",
    "title": "A bank website. No bank you can verify.",
    "short_title": "The banking portal",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "cashclaimagilitybank.com",
    "summary": "cashclaimagilitybank.com presented itself as a bank or financial service. Desenmascara rated it fraudulent (94/100) after AI-assisted analysis.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "cashclaimagilitybank-com.png",
    "image_source": "https://desenmascara.me/screens/163bc9bc546e0bd8.png",
    "image_alt": "Archived capture of cashclaimagilitybank.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 135 of 199 domains we have analysed are flagged (68%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 94/100 for cashclaimagilitybank.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-13",
    "checked_at": "2026-09-16",
    "assessment": "Fraudulent · 94/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/07e5b799-69e5-481d-998a-52ce57770b88"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-04-03 through Name SRS AB.",
        "url": "https://lookup.icann.org/en/lookup?name=cashclaimagilitybank.com"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-013",
    "slug": "repsolinvestt-shop",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "repsolinvestt.shop",
    "summary": "Captured on 2026-09-15: repsolinvestt.shop, an investment or trading platform that Desenmascara's AI-assisted analysis rated fraudulent at 93/100.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "repsolinvestt-shop.png",
    "image_source": "https://desenmascara.me/screens/80a38d2366cb9efa.png",
    "image_alt": "Archived capture of repsolinvestt.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 63 of 63 domains we have analysed are flagged (100%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for repsolinvestt.shop, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-15",
    "checked_at": "2026-09-16",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/83cba8a4-a20f-419c-b32d-cb1ecf1eb534"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-16).",
        "url": "https://www.virustotal.com/gui/domain/repsolinvestt.shop"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-014",
    "slug": "agosbitline-shop",
    "title": "Automated profits, promised by nobody you can find.",
    "short_title": "The trading platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "agosbitline.shop",
    "summary": "Desenmascara flagged agosbitline.shop as fraudulent (93/100). The site presented itself as an investment or trading platform.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "agosbitline-shop.png",
    "image_source": "https://desenmascara.me/screens/a82827fd9df6ad15.png",
    "image_alt": "Archived capture of agosbitline.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 72 of 73 domains we have analysed are flagged (99%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for agosbitline.shop, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-17",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/8f943989-787a-4834-95f3-2f02884678d2"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/agosbitline.shop"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-015",
    "slug": "oldmutualaiinvest-shop",
    "title": "Big returns. No verifiable firm behind them.",
    "short_title": "The investment offer",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "oldmutualaiinvest.shop",
    "summary": "An archived look at oldmutualaiinvest.shop, an investment or trading platform assessed as fraudulent by Desenmascara (AI-assisted analysis, 93/100).",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "oldmutualaiinvest-shop.png",
    "image_source": "https://desenmascara.me/screens/d46789ae95e9b1fc.png",
    "image_alt": "Archived capture of oldmutualaiinvest.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 72 of 73 domains we have analysed are flagged (99%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for oldmutualaiinvest.shop, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-17",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/14fba8af-ab43-467e-b88d-0a319ead8b1e"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/oldmutualaiinvest.shop"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-016",
    "slug": "chrysarinsoft-shop",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "chrysarinsoft.shop",
    "summary": "chrysarinsoft.shop presented itself as an investment or trading platform. Desenmascara rated it fraudulent (93/100) after AI-assisted analysis.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "chrysarinsoft-shop.png",
    "image_source": "https://desenmascara.me/screens/1c358b3d80342c6a.png",
    "image_alt": "Archived capture of chrysarinsoft.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 63 of 63 domains we have analysed are flagged (100%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for chrysarinsoft.shop, based on AI-assisted analysis. 15 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-17",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/e94c64eb-a399-47ff-81d9-f5194a765a2a"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 15 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/chrysarinsoft.shop"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-017",
    "slug": "clairezontbankcards-sbs",
    "title": "Automated profits, promised by nobody you can find.",
    "short_title": "The trading platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "clairezontbankcards.sbs",
    "summary": "Captured on 2026-09-16: clairezontbankcards.sbs, an investment or trading platform that Desenmascara's AI-assisted analysis rated fraudulent at 91/100.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "clairezontbankcards-sbs.png",
    "image_source": "https://desenmascara.me/screens/d0731c2b220c87b3.png",
    "image_alt": "Archived capture of clairezontbankcards.sbs, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 63 of 63 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for clairezontbankcards.sbs, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-17",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/14b80bac-06fe-4668-b264-fadd8854d79c"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/clairezontbankcards.sbs"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-02-17 through NETIM.",
        "url": "https://lookup.icann.org/en/lookup?name=clairezontbankcards.sbs"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-018",
    "slug": "prestigiomarketdex-shop",
    "title": "Big returns. No verifiable firm behind them.",
    "short_title": "The investment offer",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "prestigiomarketdex.shop",
    "summary": "Desenmascara flagged prestigiomarketdex.shop as fraudulent (93/100). The site presented itself as an investment or trading platform.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "prestigiomarketdex-shop.png",
    "image_source": "https://desenmascara.me/screens/f7166d0ba0d506a7.png",
    "image_alt": "Archived capture of prestigiomarketdex.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 72 of 73 domains we have analysed are flagged (99%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for prestigiomarketdex.shop, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-18",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/2a7bb098-6895-4e31-b02b-6a9233d86249"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-019",
    "slug": "paragonix-earn-tech-com",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "paragonix-earn-tech.com",
    "summary": "An archived look at paragonix-earn-tech.com, an investment or trading platform assessed as fraudulent by Desenmascara (AI-assisted analysis, 91/100).",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "paragonix-earn-tech-com.png",
    "image_source": "https://desenmascara.me/screens/df5200bad4519104.png",
    "image_alt": "Archived capture of paragonix-earn-tech.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 63 of 63 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for paragonix-earn-tech.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-15",
    "checked_at": "2026-09-18",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/23f74d45-5ded-466d-b702-1daf825f3bcf"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2025-11-12 through MainReg Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=paragonix-earn-tech.com"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-020",
    "slug": "meghnamoorsoftware-com",
    "title": "Automated profits, promised by nobody you can find.",
    "short_title": "The trading platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "meghnamoorsoftware.com",
    "summary": "meghnamoorsoftware.com presented itself as an investment or trading platform. Desenmascara rated it fraudulent (93/100) after AI-assisted analysis.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "meghnamoorsoftware-com.png",
    "image_source": "https://desenmascara.me/screens/f8d1e333899ce477.png",
    "image_alt": "Archived capture of meghnamoorsoftware.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 64 of 64 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for meghnamoorsoftware.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-15",
    "checked_at": "2026-09-19",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/54b4324f-8d14-49d4-8bb8-dd50d301900b"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-04-14 through MAT BAO CORPORATION.",
        "url": "https://lookup.icann.org/en/lookup?name=meghnamoorsoftware.com"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-021",
    "slug": "axel-fundriaplatform-com",
    "title": "A bank website. No bank you can verify.",
    "short_title": "The banking portal",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "axel-fundriaplatform.com",
    "summary": "Captured on 2026-09-16: axel-fundriaplatform.com, a bank or financial service that Desenmascara's AI-assisted analysis rated fraudulent at 91/100.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "axel-fundriaplatform-com.png",
    "image_source": "https://desenmascara.me/screens/962eadb172d0e1aa.png",
    "image_alt": "Archived capture of axel-fundriaplatform.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 64 of 64 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for axel-fundriaplatform.com, based on AI-assisted analysis. 15 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-19",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/6930b180-6d20-48ec-93d9-bdb936292537"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 15 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/axel-fundriaplatform.com"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2025-12-01 through MainReg Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=axel-fundriaplatform.com"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-022",
    "slug": "elitechain-finance-xyz",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "elitechain-finance.xyz",
    "summary": "Desenmascara flagged elitechain-finance.xyz as fraudulent (100/100). The site presented itself as an investment or trading platform.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "elitechain-finance-xyz.png",
    "image_source": "https://desenmascara.me/screens/f302711a97a27239.png",
    "image_alt": "Archived capture of elitechain-finance.xyz, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 51 of 56 domains we have analysed are flagged (91%).",
      "The source report records: domain registered 0 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for elitechain-finance.xyz, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-19",
    "checked_at": "2026-09-19",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/e54ad2c0-342f-4da7-b9d0-63f2d4537c8d"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-19 through Sav.com, LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=elitechain-finance.xyz"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-023",
    "slug": "instantrefundresolution-online",
    "title": "Cards and accounts, offered by no bank on record.",
    "short_title": "The bank that isn't",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "instantrefundresolution.online",
    "summary": "An archived look at instantrefundresolution.online, a bank or financial service assessed as fraudulent by Desenmascara (AI-assisted analysis, 100/100).",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "instantrefundresolution-online.png",
    "image_source": "https://desenmascara.me/screens/8c0d9c124c6dca38.png",
    "image_alt": "Archived capture of instantrefundresolution.online, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 51 of 56 domains we have analysed are flagged (91%).",
      "The source report records: domain registered 1 days ago.",
      "The source report records: suspicious TLD (.online)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for instantrefundresolution.online, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-19",
    "checked_at": "2026-09-19",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/b6d92da7-2bad-443f-9903-fd7d4facd7d9"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-18 through Spaceship, Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=instantrefundresolution.online"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-024",
    "slug": "expresscargo-xyz",
    "title": "A bank website. No bank you can verify.",
    "short_title": "The banking portal",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "expresscargo.xyz",
    "summary": "expresscargo.xyz presented itself as a bank or financial service. Desenmascara rated it fraudulent (93/100) after AI-assisted analysis.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "expresscargo-xyz.png",
    "image_source": "https://desenmascara.me/screens/d33f59ad141117a3.png",
    "image_alt": "Archived capture of expresscargo.xyz, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 103 of 134 domains we have analysed are flagged (77%).",
      "The source report records: suspicious TLD (.xyz)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for expresscargo.xyz, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-20",
    "checked_at": "2026-09-20",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/dde0fe71-2079-45a6-a9a5-726cdb3b84f5"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-08-05 through TuringSign Inc. d/b/a Cosmotown.",
        "url": "https://lookup.icann.org/en/lookup?name=expresscargo.xyz"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-025",
    "slug": "aufstieg-gaintra-tech-com",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "aufstieg-gaintra-tech.com",
    "summary": "Captured on 2026-09-16: aufstieg-gaintra-tech.com, an investment or trading platform that Desenmascara's AI-assisted analysis rated fraudulent at 91/100.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "aufstieg-gaintra-tech-com.png",
    "image_source": "https://desenmascara.me/screens/13d3fb88df8708e0.png",
    "image_alt": "Archived capture of aufstieg-gaintra-tech.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 64 of 64 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for aufstieg-gaintra-tech.com, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-20",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/3e12efbe-bbbe-46fb-9521-6029da1c2023"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/aufstieg-gaintra-tech.com"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-02-09 through MainReg Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=aufstieg-gaintra-tech.com"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-026",
    "slug": "259041-crypto-com",
    "title": "The coins are real. The platform is not verifiable.",
    "short_title": "The crypto platform",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "259041-crypto.com",
    "summary": "Desenmascara flagged 259041-crypto.com as fraudulent (82/100). The site presented itself as a crypto platform.",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "259041-crypto-com.png",
    "image_source": "https://desenmascara.me/screens/b99fd09269902dd1.png",
    "image_alt": "Archived capture of 259041-crypto.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "The source report records: domain registered 3 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 82/100 for 259041-crypto.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-20",
    "checked_at": "2026-09-21",
    "assessment": "Fraudulent · 82/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/096093b8-a614-44f1-9a91-3f5c73669d6a"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-17 through Dynadot Inc.",
        "url": "https://lookup.icann.org/en/lookup?name=259041-crypto.com"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-027",
    "slug": "remitmargin-com",
    "title": "A famous brand. A price too good to be true.",
    "short_title": "The brand storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "remitmargin.com",
    "summary": "An archived look at remitmargin.com, an online shop assessed as fraudulent by Desenmascara (heuristic analysis, 100/100).",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "remitmargin-com.png",
    "image_source": "https://desenmascara.me/screens/325f15a78901820a.png",
    "image_alt": "Archived capture of remitmargin.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 169 of 204 domains we have analysed are flagged (83%).",
      "The source report records: domain registered 14 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for remitmargin.com, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 216 known fraudulent sites; Domain registered 14 days ago; Extreme discounts detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-22",
    "checked_at": "2026-09-22",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/4d4b3a66-5b3c-48bd-aadb-7a709cd2fba9"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-08 through NAMECHEAP INC.",
        "url": "https://lookup.icann.org/en/lookup?name=remitmargin.com"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-028",
    "slug": "mt-bank-us",
    "title": "Online banking from a bank nobody licensed.",
    "short_title": "The card offer",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "mt-bank.us",
    "summary": "mt-bank.us presented itself as a bank or financial service. Desenmascara rated it fraudulent (85/100) after AI-assisted analysis.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "mt-bank-us.png",
    "image_source": "https://desenmascara.me/screens/a2d6f549289fd65e.png",
    "image_alt": "Archived capture of mt-bank.us, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 169 of 204 domains we have analysed are flagged (83%).",
      "The source report records: domain registered 0 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 85/100 for mt-bank.us, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-22",
    "checked_at": "2026-09-22",
    "assessment": "Fraudulent · 85/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/8e17b220-9146-40d0-ad4e-f94d5c3817cd"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-22 through PDR Ltd. d/b/a PublicDomainRegistry.com.",
        "url": "https://lookup.icann.org/en/lookup?name=mt-bank.us"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-029",
    "slug": "fx-alphapgims-online",
    "title": "Cards and accounts, offered by no bank on record.",
    "short_title": "The bank that isn't",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "fx-alphapgims.online",
    "summary": "Captured on 2026-09-22: fx-alphapgims.online, a bank or financial service that Desenmascara's AI-assisted analysis rated fraudulent at 100/100.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "fx-alphapgims-online.png",
    "image_source": "https://desenmascara.me/screens/513b5f55627e5a06.png",
    "image_alt": "Archived capture of fx-alphapgims.online, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 71 of 84 domains we have analysed are flagged (85%).",
      "The source report records: domain registered 0 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for fx-alphapgims.online, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-22",
    "checked_at": "2026-09-23",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/209d982e-cb27-44de-88f2-62bf2fd5b511"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-22 through NameSilo, LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=fx-alphapgims.online"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-030",
    "slug": "flavoradeextractsshop-com",
    "title": "A famous brand. A price too good to be true.",
    "short_title": "The brand storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "flavoradeextractsshop.com",
    "summary": "Desenmascara flagged flavoradeextractsshop.com as fraudulent (96/100). The site presented itself as an online shop.",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "flavoradeextractsshop-com.png",
    "image_source": "https://desenmascara.me/screens/ea8c5ee51835bbfa.png",
    "image_alt": "Archived capture of flavoradeextractsshop.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 32 of 46 domains we have analysed are flagged (70%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 96/100 for flavoradeextractsshop.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-23",
    "checked_at": "2026-09-23",
    "assessment": "Fraudulent · 96/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/9a4711e4-97ab-4697-804c-3421f4834152"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-03-27 through ENOM, INC..",
        "url": "https://lookup.icann.org/en/lookup?name=flavoradeextractsshop.com"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-031",
    "slug": "diamondevercrest-com",
    "title": "Deep discounts from a shop with no known owner.",
    "short_title": "The bargain store",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "diamondevercrest.com",
    "summary": "An archived look at diamondevercrest.com, an online shop assessed as fraudulent by Desenmascara (AI-assisted analysis, 93/100).",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "diamondevercrest-com.png",
    "image_source": "https://desenmascara.me/screens/64b0b0dd9ccdcfef.png",
    "image_alt": "Archived capture of diamondevercrest.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 63 of 87 domains we have analysed are flagged (72%).",
      "The source report records: domain registered today."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for diamondevercrest.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-23",
    "checked_at": "2026-09-24",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/899edcb2-b9ba-4da0-af19-e462c29ddfe9"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-23 through Dynadot Inc.",
        "url": "https://lookup.icann.org/en/lookup?name=diamondevercrest.com"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-032",
    "slug": "elvarionbank-com",
    "title": "Cards and accounts, offered by no bank on record.",
    "short_title": "The bank that isn't",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "elvarionbank.com",
    "summary": "elvarionbank.com presented itself as a bank or financial service. Desenmascara rated it fraudulent (82/100) after AI-assisted analysis.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "elvarionbank-com.png",
    "image_source": "https://desenmascara.me/screens/4189a5042dc3fe82.png",
    "image_alt": "Archived capture of elvarionbank.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 172 of 210 domains we have analysed are flagged (82%).",
      "The source report records: domain registered 2 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 82/100 for elvarionbank.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-24",
    "checked_at": "2026-09-24",
    "assessment": "Fraudulent · 82/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/af9db94c-b9e7-4a1b-a4d3-5312da36eee8"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-22 through Dynadot Inc.",
        "url": "https://lookup.icann.org/en/lookup?name=elvarionbank.com"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-033",
    "slug": "skybitprofits-com",
    "title": "A famous brand. A price too good to be true.",
    "short_title": "The brand storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "skybitprofits.com",
    "summary": "Captured on 2026-09-25: skybitprofits.com, an online shop that Desenmascara's heuristic analysis rated fraudulent at 95/100.",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "skybitprofits-com.png",
    "image_source": "https://desenmascara.me/screens/f987b23c3a484bfc.png",
    "image_alt": "Archived capture of skybitprofits.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 72 of 92 domains we have analysed are flagged (78%).",
      "The source report records: domain registered 10 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 95/100 for skybitprofits.com, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 207 known fraudulent sites; Domain registered 10 days ago; Extreme discounts detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-25",
    "checked_at": "2026-09-25",
    "assessment": "Fraudulent · 95/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/c4cf5646-ecad-4376-836e-fd1278ec73f0"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-15 through TuringSign Inc. d/b/a Cosmotown.",
        "url": "https://lookup.icann.org/en/lookup?name=skybitprofits.com"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-034",
    "slug": "yappeakcappaid-top",
    "title": "Crypto earnings, on a site nobody stands behind.",
    "short_title": "The wallet lure",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "yappeakcappaid.top",
    "summary": "Desenmascara flagged yappeakcappaid.top as fraudulent (99/100). The site presented itself as a crypto platform.",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "yappeakcappaid-top.png",
    "image_source": "https://desenmascara.me/screens/8e08b5bfbe37b4c6.png",
    "image_alt": "Archived capture of yappeakcappaid.top, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 18 of 34 domains we have analysed are flagged (53%).",
      "The source report records: domain registered 5 days ago.",
      "The source report records: suspicious TLD (.top)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 99/100 for yappeakcappaid.top, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-25",
    "checked_at": "2026-09-25",
    "assessment": "Fraudulent · 99/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/f6a7cc29-90f5-471a-b447-ec5666d27194"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-20 through NameSilo, LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=yappeakcappaid.top"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-035",
    "slug": "tesladealer-co-za",
    "title": "The coins are real. The platform is not verifiable.",
    "short_title": "The crypto platform",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "tesladealer.co.za",
    "summary": "An archived look at tesladealer.co.za, a crypto platform assessed as fraudulent by Desenmascara (AI-assisted analysis, 100/100).",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "tesladealer-co-za.png",
    "image_source": "https://desenmascara.me/screens/2a3c350f64c5c2ae.png",
    "image_alt": "Archived capture of tesladealer.co.za, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "The source report records: hosted on an address where 165 of 302 domains we have analysed are flagged (55%).",
      "The source report records: domain registered 1 day ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for tesladealer.co.za, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-28",
    "checked_at": "2026-09-28",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/d1fc7cb2-9c1c-41a8-bab8-fc518cf3a34a"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-27 through PDR Ltd..",
        "url": "https://lookup.icann.org/en/lookup?name=tesladealer.co.za"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-036",
    "slug": "primecrestoptions-com",
    "title": "A famous brand. A price too good to be true.",
    "short_title": "The brand storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "primecrestoptions.com",
    "summary": "primecrestoptions.com presented itself as an online shop. Desenmascara rated it fraudulent (91/100) after heuristic analysis.",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "primecrestoptions-com.png",
    "image_source": "https://desenmascara.me/screens/22f146c0e1e4008a.png",
    "image_alt": "Archived capture of primecrestoptions.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 165 of 302 domains we have analysed are flagged (55%).",
      "The source report records: domain registered today."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for primecrestoptions.com, based on heuristic analysis. Its analysis says: “What we found: Domain registered today; Extreme discounts detected; Financial theme detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-28",
    "checked_at": "2026-09-28",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/a082bc04-0e82-4554-bf83-af89b4bc054c"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-28 through Dynadot Inc.",
        "url": "https://lookup.icann.org/en/lookup?name=primecrestoptions.com"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-039",
    "slug": "psychedelicsx-com",
    "title": "A famous brand. A price too good to be true.",
    "short_title": "The brand storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "psychedelicsx.com",
    "summary": "An archived look at psychedelicsx.com, an online shop assessed as fraudulent by Desenmascara (heuristic analysis, 99/100).",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "psychedelicsx-com.png",
    "image_source": "https://desenmascara.me/screens/11189f9ee1ab51a2.png",
    "image_alt": "Archived capture of psychedelicsx.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 24 of 46 domains we have analysed are flagged (52%).",
      "The source report records: domain registered 22 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 99/100 for psychedelicsx.com, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 23 known fraudulent sites; Domain registered 22 days ago; Extreme discounts detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-29",
    "checked_at": "2026-09-29",
    "assessment": "Fraudulent · 99/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/2c317b5c-b12e-4082-83b7-40ad1e734f13"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-07 through NICENIC INTERNATIONAL GROUP CO., LIMITED.",
        "url": "https://lookup.icann.org/en/lookup?name=psychedelicsx.com"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-040",
    "slug": "elonxinvest-com",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "elonxinvest.com",
    "summary": "elonxinvest.com presented itself as an investment or trading platform. Desenmascara rated it fraudulent (93/100) after heuristic analysis.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "elonxinvest-com.png",
    "image_source": "https://desenmascara.me/screens/47df95afa5099bcf.png",
    "image_alt": "Archived capture of elonxinvest.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 43 of 55 domains we have analysed are flagged (78%).",
      "The source report records: domain registered today."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for elonxinvest.com, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 120 known fraudulent sites; Domain registered today; Financial theme detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-29",
    "checked_at": "2026-09-29",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/cefd246c-7669-4450-b65e-3957f7ede3a2"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-29 through TuringSign Inc. d/b/a Cosmotown.",
        "url": "https://lookup.icann.org/en/lookup?name=elonxinvest.com"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-041",
    "slug": "thelansbankse-com",
    "title": "Cards and accounts, offered by no bank on record.",
    "short_title": "The bank that isn't",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "thelansbankse.com",
    "summary": "Captured on 2026-09-30: thelansbankse.com, a bank or financial service that Desenmascara's heuristic analysis rated fraudulent at 90/100.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "thelansbankse-com.png",
    "image_source": "https://desenmascara.me/screens/508211945c910b6c.png",
    "image_alt": "Archived capture of thelansbankse.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 83 of 140 domains we have analysed are flagged (59%).",
      "The source report records: domain registered 1 day ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 90/100 for thelansbankse.com, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 164 known fraudulent sites; Domain registered 1 day ago; Financial theme detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-30",
    "checked_at": "2026-10-01",
    "assessment": "Fraudulent · 90/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/f02944cc-02c7-464b-891c-f724c14ef70a"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-29 through PDR Ltd. d/b/a PublicDomainRegistry.com.",
        "url": "https://lookup.icann.org/en/lookup?name=thelansbankse.com"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-042",
    "slug": "gemspins-net",
    "title": "A crypto platform. A wallet you should not connect.",
    "short_title": "The crypto earnings site",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "gemspins.net",
    "summary": "Desenmascara flagged gemspins.net as fraudulent (84/100). The site presented itself as a crypto platform.",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "gemspins-net.png",
    "image_source": "https://desenmascara.me/screens/61e9d73e6a6b2ddc.png",
    "image_alt": "Archived capture of gemspins.net, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "Asks for payment by crypto or bank transfer.",
      "The source report records: domain registered 14 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 84/100 for gemspins.net, based on heuristic analysis. Its analysis says: “What we found: Domain registered 14 days ago; Financial theme detected; Accepted payment methods: bank transfer, cryptocurrency.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-30",
    "checked_at": "2026-10-01",
    "assessment": "Fraudulent · 84/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/e2254811-7f44-48f9-b508-894c01a48e26"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-16 through DYNADOT LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=gemspins.net"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-043",
    "slug": "interactivepromarkets-top",
    "title": "Crypto earnings, on a site nobody stands behind.",
    "short_title": "The wallet lure",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "interactivepromarkets.top",
    "summary": "An archived look at interactivepromarkets.top, a crypto platform assessed as fraudulent by Desenmascara (AI-assisted analysis, 100/100).",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "interactivepromarkets-top.png",
    "image_source": "https://desenmascara.me/screens/c9ca59926b0f7fd6.png",
    "image_alt": "Archived capture of interactivepromarkets.top, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "The source report records: hosted on an address where 87 of 147 domains we have analysed are flagged (59%).",
      "The source report records: domain registered today.",
      "The source report records: suspicious TLD (.top)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for interactivepromarkets.top, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-01",
    "checked_at": "2026-10-01",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/95599d8b-b89b-4479-8a50-d81aa572e8cb"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-01 through Dynadot LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=interactivepromarkets.top"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-044",
    "slug": "nhbnyc-com",
    "title": "A familiar storefront. An unknown seller.",
    "short_title": "The discount shop",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "nhbnyc.com",
    "summary": "nhbnyc.com presented itself as an online shop. Desenmascara rated it fraudulent (85/100) after heuristic analysis.",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "nhbnyc-com.png",
    "image_source": "https://desenmascara.me/screens/912d6967a4c2234b.png",
    "image_alt": "Archived capture of nhbnyc.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 179 of 341 domains we have analysed are flagged (52%).",
      "The source report records: domain registered today."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 85/100 for nhbnyc.com, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 166 known fraudulent sites; Domain registered today; Extreme discounts detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-02",
    "checked_at": "2026-10-02",
    "assessment": "Fraudulent · 85/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/476e80a5-4c94-4965-b87d-c510616a6838"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-02 through Ultahost, Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=nhbnyc.com"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-045",
    "slug": "spacexaccess-co",
    "title": "A famous brand. A price too good to be true.",
    "short_title": "The brand storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "spacexaccess.co",
    "summary": "Captured on 2026-10-02: spacexaccess.co, an online shop that Desenmascara's heuristic analysis rated fraudulent at 87/100.",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "spacexaccess-co.png",
    "image_source": "https://desenmascara.me/screens/4cc96b960648efc5.png",
    "image_alt": "Archived capture of spacexaccess.co, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 190 of 377 domains we have analysed are flagged (50%).",
      "The source report records: domain registered today."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 87/100 for spacexaccess.co, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 168 known fraudulent sites; Domain registered today; Extreme discounts detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-02",
    "checked_at": "2026-10-03",
    "assessment": "Fraudulent · 87/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/51cf10f3-6b74-43c4-8a04-3cd6f58b216b"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-02 through Dynadot Inc.",
        "url": "https://lookup.icann.org/en/lookup?name=spacexaccess.co"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-046",
    "slug": "bonavisbank-com",
    "title": "Online banking from a bank nobody licensed.",
    "short_title": "The card offer",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "bonavisbank.com",
    "summary": "Desenmascara flagged bonavisbank.com as fraudulent (82/100). The site presented itself as a bank or financial service.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "bonavisbank-com.png",
    "image_source": "https://desenmascara.me/screens/8ee1d2f29edd983f.png",
    "image_alt": "Archived capture of bonavisbank.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 178 of 251 domains we have analysed are flagged (71%).",
      "The source report records: domain registered 1 day ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 82/100 for bonavisbank.com, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 239 known fraudulent sites; Domain registered 1 day ago; Financial theme detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-02",
    "checked_at": "2026-10-03",
    "assessment": "Fraudulent · 82/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/65c62052-8d7d-493f-8651-b9d4280231f8"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-01 through PDR Ltd. d/b/a PublicDomainRegistry.com.",
        "url": "https://lookup.icann.org/en/lookup?name=bonavisbank.com"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-047",
    "slug": "copy-intere-wallet-org",
    "title": "A familiar storefront. An unknown seller.",
    "short_title": "The discount shop",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "copy.intere-wallet.org",
    "summary": "An archived look at copy.intere-wallet.org, an online shop assessed as fraudulent by Desenmascara (heuristic analysis, 92/100).",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "copy-intere-wallet-org.png",
    "image_source": "https://desenmascara.me/screens/04f1eb1ecdb10e3f.png",
    "image_alt": "Archived capture of copy.intere-wallet.org, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 174 of 377 domains we have analysed are flagged (46%).",
      "The source report records: domain registered today."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 92/100 for copy.intere-wallet.org, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 180 known fraudulent sites; Domain registered today; Extreme discounts detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-03",
    "checked_at": "2026-10-04",
    "assessment": "Fraudulent · 92/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/ef5cc640-89c8-4796-b260-b86a3a46d66f"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-03 through Name.com, Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=copy.intere-wallet.org"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-048",
    "slug": "merionpay-com-intere-wallet-org",
    "title": "A crypto platform. A wallet you should not connect.",
    "short_title": "The crypto earnings site",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "merionpay.com.intere-wallet.org",
    "summary": "merionpay.com.intere-wallet.org presented itself as a crypto platform. Desenmascara rated it fraudulent (88/100) after heuristic analysis.",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "merionpay-com-intere-wallet-org.png",
    "image_source": "https://desenmascara.me/screens/9f77428f0e090b3a.png",
    "image_alt": "Archived capture of merionpay.com.intere-wallet.org, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "The source report records: hosted on an address where 174 of 377 domains we have analysed are flagged (46%).",
      "The source report records: domain registered today."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 88/100 for merionpay.com.intere-wallet.org, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 179 known fraudulent sites; Domain registered today; Financial theme detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-03",
    "checked_at": "2026-10-04",
    "assessment": "Fraudulent · 88/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/aa201187-07ab-4564-87ee-1ddd7077a251"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-03 through Name.com, Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=merionpay.com.intere-wallet.org"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-049",
    "slug": "segurosoat-mundial-top",
    "title": "Online banking from a bank nobody licensed.",
    "short_title": "The card offer",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "segurosoat-mundial.top",
    "summary": "Captured on 2026-10-05: segurosoat-mundial.top, a bank or financial service that Desenmascara's AI-assisted analysis rated fraudulent at 98/100.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "segurosoat-mundial-top.png",
    "image_source": "https://desenmascara.me/screens/58a7d33f7ad9f8da.png",
    "image_alt": "Archived capture of segurosoat-mundial.top, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "Social media icons do not lead to real profiles.",
      "The source report records: hosted on an address where 17 of 18 domains we have analysed are flagged (94%).",
      "The source report records: domain registered 4 days ago.",
      "The source report records: suspicious TLD (.top)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 98/100 for segurosoat-mundial.top, based on AI-assisted analysis. Its analysis says: “The site claims to offer SOAT insurance services but is hosted on a very recent domain (only 4 days old) associated with a high-risk fraud infrastructure cluster.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-05",
    "checked_at": "2026-10-05",
    "assessment": "Fraudulent · 98/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/186b5c64-bfb5-48a8-8f98-f1d5ee9b4c81"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-01 through NICENIC INTERNATIONAL GROUP CO., LIMITED.",
        "url": "https://lookup.icann.org/en/lookup?name=segurosoat-mundial.top"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-050",
    "slug": "bancodealimentocol-top",
    "title": "A familiar storefront. An unknown seller.",
    "short_title": "The discount shop",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "bancodealimentocol.top",
    "summary": "Desenmascara flagged bancodealimentocol.top as fraudulent (97/100). The site presented itself as an online shop.",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "bancodealimentocol-top.png",
    "image_source": "https://desenmascara.me/screens/06032e03590cef0a.png",
    "image_alt": "Archived capture of bancodealimentocol.top, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 17 of 18 domains we have analysed are flagged (94%).",
      "The source report records: domain registered 4 days ago.",
      "The source report records: suspicious TLD (.top)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 97/100 for bancodealimentocol.top, based on heuristic analysis. Its analysis says: “What we found: Domain registered 4 days ago; Suspicious TLD (.top); Extreme discounts detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-05",
    "checked_at": "2026-10-05",
    "assessment": "Fraudulent · 97/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/b1e91ffd-9b19-45ba-bc34-288ea6d1c1bb"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-01 through NICENIC INTERNATIONAL GROUP CO., LIMITED.",
        "url": "https://lookup.icann.org/en/lookup?name=bancodealimentocol.top"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-051",
    "slug": "metachore-net",
    "title": "A famous brand. A price too good to be true.",
    "short_title": "The brand storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "metachore.net",
    "summary": "An archived look at metachore.net, an online shop assessed as fraudulent by Desenmascara (heuristic analysis, 100/100).",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "metachore-net.png",
    "image_source": "https://desenmascara.me/screens/dbc8bd3413cb7ead.png",
    "image_alt": "Archived capture of metachore.net, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 10 of 16 domains we have analysed are flagged (62%).",
      "The source report records: domain registered 5 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for metachore.net, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 34 known fraudulent sites; Domain registered 5 days ago; Extreme discounts detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-06",
    "checked_at": "2026-10-06",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/fea2bb10-80b8-4200-9069-d3685ffaace9"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-01 through TuringSign Inc. d/b/a Cosmotown.",
        "url": "https://lookup.icann.org/en/lookup?name=metachore.net"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-052",
    "slug": "creatorscashpage-online",
    "title": "Deep discounts from a shop with no known owner.",
    "short_title": "The bargain store",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "creatorscashpage.online",
    "summary": "creatorscashpage.online presented itself as an online shop. Desenmascara rated it fraudulent (95/100) after AI-assisted analysis.",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "creatorscashpage-online.png",
    "image_source": "https://desenmascara.me/screens/c6a19c1a19e84e3d.png",
    "image_alt": "Archived capture of creatorscashpage.online, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 183 of 400 domains we have analysed are flagged (46%).",
      "The source report records: domain registered today."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 95/100 for creatorscashpage.online, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-06",
    "checked_at": "2026-10-07",
    "assessment": "Fraudulent · 95/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/2dd92c97-8f14-4dd7-b85e-589e3408a5ea"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-06 through Dynadot Inc.",
        "url": "https://lookup.icann.org/en/lookup?name=creatorscashpage.online"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-053",
    "slug": "pagodetarjetastuya-top",
    "title": "The brand is borrowed. The form is the trap.",
    "short_title": "The phishing page",
    "category": "Phishing",
    "technique": "Credential phishing",
    "kind": "capture",
    "subject": "pagodetarjetastuya.top",
    "summary": "Captured on 2026-10-05: pagodetarjetastuya.top, a familiar online service that Desenmascara's AI-assisted analysis rated fraudulent at 97/100.",
    "lesson": "Open a service from its official app or a saved address, never from a link you were sent, before entering a password or payment details.",
    "image": "pagodetarjetastuya-top.png",
    "image_source": "https://desenmascara.me/screens/76b052e47c25c71b.png",
    "image_alt": "Archived capture of pagodetarjetastuya.top, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this the real service's own address?",
    "observations": [
      "Desenmascara rated it fraudulent before PhishDestroy's DestroyList listed it.",
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 17 of 18 domains we have analysed are flagged (94%).",
      "The source report records: suspicious TLD (.top)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 97/100 for pagodetarjetastuya.top, based on AI-assisted analysis. Its analysis says: “This domain (pagodetarjetastuya.top) carries the brand name 'Tuya' inside the domain name alongside extra terms, on a low-reputation .top TLD — the structure typical of brand-impersonation phishing/smishing kits, not the brand's official site.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-05",
    "checked_at": "2026-10-09",
    "assessment": "Fraudulent · 97/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/212bbe8d-66c7-4d7d-9b51-56a34ebcb09b"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-02-14 through NICENIC INTERNATIONAL GROUP CO., LIMITED.",
        "url": "https://lookup.icann.org/en/lookup?name=pagodetarjetastuya.top"
      }
    ],
    "audience": "Anyone asked to sign in or confirm details"
  },
  {
    "id": "SA-054",
    "slug": "wealthpasselltd-cc",
    "title": "Big returns. No verifiable firm behind them.",
    "short_title": "The investment offer",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "wealthpasselltd.cc",
    "summary": "Desenmascara flagged wealthpasselltd.cc as fraudulent (95/100). The site presented itself as an investment or trading platform.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "wealthpasselltd-cc.png",
    "image_source": "https://desenmascara.me/screens/05b426e30f3d96a6.png",
    "image_alt": "Archived capture of wealthpasselltd.cc, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "Desenmascara rated it fraudulent before PhishDestroy's DestroyList listed it.",
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 88 of 143 domains we have analysed are flagged (62%).",
      "The source report records: domain registered 1 day ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 95/100 for wealthpasselltd.cc, based on heuristic analysis. Its analysis says: “What we found: Page identical to 30 sites already classified as fraudulent; Its server hosts 429 known fraudulent sites; Domain registered 1 day ago.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-07",
    "checked_at": "2026-10-09",
    "assessment": "Fraudulent · 95/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/4271ce34-a998-4aab-8ec5-36f29befe92b"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-10-06 through NameSilo, LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=wealthpasselltd.cc"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-055",
    "slug": "globalfirstclasstraders-live",
    "title": "Crypto earnings, on a site nobody stands behind.",
    "short_title": "The wallet lure",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "globalfirstclasstraders.live",
    "summary": "An archived look at globalfirstclasstraders.live, a crypto platform assessed as fraudulent by Desenmascara (AI-assisted analysis, 88/100).",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "globalfirstclasstraders-live.png",
    "image_source": "https://desenmascara.me/screens/5a238e8c6f64c4f7.png",
    "image_alt": "Archived capture of globalfirstclasstraders.live, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "The source report records: hosted on an address where 171 of 388 domains we have analysed are flagged (44%).",
      "The source report records: suspicious TLD (.live)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 88/100 for globalfirstclasstraders.live, based on AI-assisted analysis. Its analysis says: “The site presents itself as a financial investment platform offering forex, binary options, and cryptocurrency services, which is a common facade for scams.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-09",
    "checked_at": "2026-10-09",
    "assessment": "Fraudulent · 88/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/de10ecac-26db-4c7e-9acc-0fd863435aeb"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-056",
    "slug": "plataformadeinvestimentos-net",
    "title": "Automated profits, promised by nobody you can find.",
    "short_title": "The trading platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "plataformadeinvestimentos.net",
    "summary": "plataformadeinvestimentos.net presented itself as an investment or trading platform. Desenmascara rated it fraudulent (83/100) after AI-assisted analysis.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "plataformadeinvestimentos-net.png",
    "image_source": "https://desenmascara.me/screens/7e4478d530fc54b1.png",
    "image_alt": "Archived capture of plataformadeinvestimentos.net, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 90 of 107 domains we have analysed are flagged (84%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 83/100 for plataformadeinvestimentos.net, based on AI-assisted analysis. Its analysis says: “The site presents itself as an investment platform promising daily earnings through trading, which is a common tactic in fraudulent schemes.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-09",
    "checked_at": "2026-10-09",
    "assessment": "Fraudulent · 83/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/f1c01f31-22e9-47f6-956f-20b32db6dbcc"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-057",
    "slug": "assetscommercebank-com",
    "title": "A bank website. No bank you can verify.",
    "short_title": "The banking portal",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "assetscommercebank.com",
    "summary": "Captured on 2026-10-09: assetscommercebank.com, a bank or financial service that Desenmascara's AI-assisted analysis rated fraudulent at 95/100.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "assetscommercebank-com.png",
    "image_source": "https://desenmascara.me/screens/52ec0ab4e080f5cc.png",
    "image_alt": "Archived capture of assetscommercebank.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "Desenmascara rated it fraudulent before PhishDestroy's DestroyList listed it.",
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 92 of 152 domains we have analysed are flagged (61%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 95/100 for assetscommercebank.com, based on AI-assisted analysis. Its analysis says: “The site impersonates a banking institution, claiming to be 'Assets Commerce Bank – Global Financial Services', but there are significant concerns regarding its legitimacy.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-09",
    "checked_at": "2026-10-10",
    "assessment": "Fraudulent · 95/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/f5250f34-bd15-4e6e-8273-435a25a36075"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-058",
    "slug": "investment24profit-top",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "investment24profit.top",
    "summary": "Desenmascara flagged investment24profit.top as fraudulent (92/100). The site presented itself as an investment or trading platform.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "investment24profit-top.png",
    "image_source": "https://desenmascara.me/screens/6b41dda28d65c205.png",
    "image_alt": "Archived capture of investment24profit.top, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 87 of 155 domains we have analysed are flagged (56%).",
      "The source report records: suspicious TLD (.top)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 92/100 for investment24profit.top, based on AI-assisted analysis. Its analysis says: “The site Investment24profit presents itself as a CFD trading platform, but it is newly registered with a domain age of 0 days, which is a significant risk signal.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-10",
    "checked_at": "2026-10-10",
    "assessment": "Fraudulent · 92/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/051eb731-33dd-42e8-96bc-b1a1dcbe5067"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-059",
    "slug": "luminexcapitalstrade-com",
    "title": "Automated profits, promised by nobody you can find.",
    "short_title": "The trading platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "luminexcapitalstrade.com",
    "summary": "An archived look at luminexcapitalstrade.com, an investment or trading platform assessed as fraudulent by Desenmascara (AI-assisted analysis, 93/100).",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "luminexcapitalstrade-com.png",
    "image_source": "https://desenmascara.me/screens/3a56722da7c5c231.png",
    "image_alt": "Archived capture of luminexcapitalstrade.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 156 of 366 domains we have analysed are flagged (43%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for luminexcapitalstrade.com, based on AI-assisted analysis. Its analysis says: “The site presents itself as a trading platform for CFDs, but it is registered for only 0 days, indicating a very recent creation, which is a significant risk signal.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-11",
    "checked_at": "2026-10-11",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/6149fd01-4903-4ac7-9b10-3a0c57798b2f"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-060",
    "slug": "diamondwealths-com",
    "title": "A crypto platform. A wallet you should not connect.",
    "short_title": "The crypto earnings site",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "diamondwealths.com",
    "summary": "diamondwealths.com presented itself as a crypto platform. Desenmascara rated it fraudulent (91/100) after AI-assisted analysis.",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "diamondwealths-com.png",
    "image_source": "https://desenmascara.me/screens/d4a8dc7b893bd310.png",
    "image_alt": "Archived capture of diamondwealths.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 18 of 18 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for diamondwealths.com, based on AI-assisted analysis. Its analysis says: “The site presents itself as a cryptocurrency trading and asset management company but shows multiple red flags indicative of a scam.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-11",
    "checked_at": "2026-10-11",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/659cea58-0a40-4f03-b462-65fc922d78e6"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-061",
    "slug": "tradeplus24-live",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "tradeplus24.live",
    "summary": "tradeplus24.live is flagged by a financial regulator. Desenmascara publishes it as fraudulent (100/100) on that attribution, not as its own finding (captured on 2026-10-11).",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "tradeplus24-live.png",
    "image_source": "https://desenmascara.me/screens/ae58720252358401.png",
    "image_alt": "Archived capture of tradeplus24.live, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: official warning from Australian Securities and Investments Commission (Australia) naming TradePlus24 (tradeplus24.live).",
      "The source report records: suspicious TLD (.live)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for tradeplus24.live, based on attributed financial regulator warning. The verdict is the third-party listing's, reported with attribution, not an independent finding. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-11",
    "checked_at": "2026-10-11",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · attributed financial regulator warning",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: attributed financial regulator warning",
        "url": "https://desenmascara.me/analisis/700ad782-680b-4a06-a200-6f75d0dd4332"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-062",
    "slug": "btcknotusv154-live",
    "title": "The coins are real. The platform is not verifiable.",
    "short_title": "The crypto platform",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "btcknotusv154.live",
    "summary": "btcknotusv154.live is flagged by a financial regulator. Desenmascara publishes it as fraudulent (100/100) on that attribution, not as its own finding (captured on 2026-10-11).",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "btcknotusv154-live.png",
    "image_source": "https://desenmascara.me/screens/1d0a253bc03862e4.png",
    "image_alt": "Archived capture of btcknotusv154.live, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "The source report records: official warning from Australian Securities and Investments Commission (Australia) naming BTC Knotus V15.4 (btcknotusv154.live).",
      "The source report records: suspicious TLD (.live)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for btcknotusv154.live, based on attributed financial regulator warning. The verdict is the third-party listing's, reported with attribution, not an independent finding. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-11",
    "checked_at": "2026-10-11",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · attributed financial regulator warning",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: attributed financial regulator warning",
        "url": "https://desenmascara.me/analisis/e63b1d32-8f80-4ee8-9ada-3cb9416f2ff4"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-063",
    "slug": "renovae-app-ai-builder-takedown",
    "title": "Built with an AI website builder. Warned by a regulator. Taken down by the platform.",
    "short_title": "The investment site the builder removed",
    "category": "Investment",
    "technique": "Investment platform built on an AI website builder",
    "kind": "capture",
    "subject": "renovae.app",
    "summary": "renovae.app presented an investment service under the name Renovae. Quebec's financial regulator, the Autorité des marchés financiers, warned on 24 August 2026 that Renovae is not authorised. When desenmascara.me analysed the domain on 11 October 2026, the site was gone: it served a takedown notice from Lovable's Trust & Safety team, the AI website builder it was built on.",
    "lesson": "A professional-looking investment website can be built in an afternoon with an AI website builder. Before you send money, look the firm up in your own country's financial regulator register, and treat a site that disappears behind a platform's takedown notice as a warning about every other site run by the same people.",
    "image": "renovae-app.png",
    "image_source": "https://desenmascara.me/screens/257a3331375e8312.png",
    "image_alt": "Capture of renovae.app on 11 October 2026: a Lovable Trust & Safety website takedown notice.",
    "claim": "An investment platform",
    "counterclaim": "Is the firm in your regulator's register?",
    "observations": [
      "Official warning from the Autorité des marchés financiers (Quebec) naming Renovae, dated 24 August 2026, as published through IOSCO's I-SCAN alerts.",
      "On 11 October 2026 the domain served \"Website Takedown Notice\": the site had been taken down by Lovable's Trust & Safety team.",
      "The same takedown notice, on the same platform, was found the same day on stanlakegroup.co.uk, another investment firm warned by a regulator (see SA-064)."
    ],
    "source_summary": "Desenmascara publishes renovae.app as Fraudulent: the attributed regulator warning is corroborated by the hosting platform's own abuse takedown. The takedown notice is Lovable's, captured by Desenmascara on 11 October 2026. Follow the report for the full record and any later correction.",
    "limits": "This case documents a regulator's public warning and the hosting platform's takedown notice; it is not an independent investigation by this project. The capture shows the takedown notice, not the original site. A regulator's \"unauthorised\" warning concerns licensing in that jurisdiction and does not by itself prove fraud, customer losses or operator identity. The platform does not publish why it removed the site. If either source withdraws its notice, this case is withdrawn too.",
    "analysis_date": "2026-10-11",
    "checked_at": "2026-10-12",
    "assessment": "Fraudulent · regulator warning corroborated by platform takedown",
    "assessment_source": "Autorité des marchés financiers (Quebec), via IOSCO I-SCAN; Lovable Trust & Safety notice",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and capture of the takedown notice · 11 October 2026",
        "url": "https://desenmascara.me/analisis/acdb114f-1f65-46ee-82b8-4b75b75198bf"
      },
      {
        "name": "IOSCO I-SCAN",
        "short": "IOSCO",
        "role": "International alerts network republishing the AMF (Quebec) warning on Renovae · 24 August 2026",
        "url": "https://www.iosco.org/i-scan/"
      }
    ],
    "audience": "Retail investors and anyone offered an online investment account"
  },
  {
    "id": "SA-064",
    "slug": "stanlake-group-ai-builder-takedown",
    "title": "Two domains, one warning, the same takedown notice.",
    "short_title": "The firm that moved domains",
    "category": "Investment",
    "technique": "Investment platform built on an AI website builder",
    "kind": "capture",
    "subject": "stanlakegroup.co.uk",
    "summary": "stanlakegroup.co.uk presented an investment firm called Stanlake Group. The UK Financial Conduct Authority warned on 6 August 2026 that Stanlake Group is not authorised. On 11 October 2026 the domain redirected to a second domain, stanlakeltd.com, and both ended at a takedown notice from Lovable's Trust & Safety team.",
    "lesson": "A professional-looking investment website can be built in an afternoon with an AI website builder. Before you send money, look the firm up in your own country's financial regulator register, and treat a site that disappears behind a platform's takedown notice as a warning about every other site run by the same people.",
    "image": "stanlakegroup-co-uk.png",
    "image_source": "https://desenmascara.me/screens/7153071635429b2c.png",
    "image_alt": "Capture of stanlakegroup.co.uk on 11 October 2026: a Lovable Trust & Safety website takedown notice.",
    "claim": "An established investment group",
    "counterclaim": "Why does it need a second domain?",
    "observations": [
      "Official warning from the Financial Conduct Authority (United Kingdom) naming Stanlake Group, dated 6 August 2026, as published through IOSCO's I-SCAN alerts.",
      "The .co.uk domain was registered on 21 January 2026, according to its registry record.",
      "On 11 October 2026 it redirected to www.stanlakeltd.com, which served Lovable's Trust & Safety takedown notice.",
      "The same notice, on the same platform, was found the same day on renovae.app, warned by Quebec's regulator (see SA-063)."
    ],
    "source_summary": "Desenmascara publishes stanlakegroup.co.uk as Fraudulent: the attributed regulator warning is corroborated by the hosting platform's own abuse takedown. The redirect and the takedown notice were captured by Desenmascara on 11 October 2026. Follow the report for the full record and any later correction.",
    "limits": "This case documents a regulator's public warning and the hosting platform's takedown notice; it is not an independent investigation by this project. The capture shows the takedown notice, not the original site. A regulator's \"unauthorised\" warning concerns licensing in that jurisdiction and does not by itself prove fraud, customer losses or operator identity. The platform does not publish why it removed the site. If either source withdraws its notice, this case is withdrawn too.",
    "analysis_date": "2026-10-11",
    "checked_at": "2026-10-12",
    "assessment": "Fraudulent · regulator warning corroborated by platform takedown",
    "assessment_source": "Financial Conduct Authority (UK), via IOSCO I-SCAN; Lovable Trust & Safety notice",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and capture of the takedown notice · 11 October 2026",
        "url": "https://desenmascara.me/analisis/7b32aa04-9e7a-4078-8304-0c2c2c1c400d"
      },
      {
        "name": "IOSCO I-SCAN",
        "short": "IOSCO",
        "role": "International alerts network republishing the FCA warning on Stanlake Group · 6 August 2026",
        "url": "https://www.iosco.org/i-scan/"
      }
    ],
    "audience": "Retail investors and anyone offered an online investment account"
  },
  {
    "id": "SA-066",
    "slug": "fpiugov-org",
    "title": "Easy earnings. Pay first to withdraw.",
    "short_title": "The online job",
    "category": "Jobs",
    "technique": "Advance-fee request",
    "kind": "capture",
    "subject": "fpiugov.org",
    "summary": "fpiugov.org is flagged by a financial regulator. Desenmascara publishes it as fraudulent (100/100) on that attribution, not as its own finding (captured on 2026-10-12).",
    "lesson": "A number on a dashboard does not prove that withdrawable earnings exist. Do not send money to release supposed wages.",
    "image": "fpiugov-org.png",
    "image_source": "https://desenmascara.me/screens/3347a799139e0c27.png",
    "image_alt": "Archived capture of fpiugov.org, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "A displayed balance is not proof of withdrawable earnings",
    "observations": [
      "The source report records: official warning from Securities and Exchange Commission (United States of America) naming Financial Protection Intelligence Unit."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for fpiugov.org, based on attributed financial regulator warning. The verdict is the third-party listing's, reported with attribution, not an independent finding. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-12",
    "checked_at": "2026-10-12",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · attributed financial regulator warning",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: attributed financial regulator warning",
        "url": "https://desenmascara.me/analisis/11dffd10-770b-4618-8b7d-601ec1dcad05"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-03-12 through Stichting Registrar of Last Resort Foundation.",
        "url": "https://lookup.icann.org/en/lookup?name=fpiugov.org"
      }
    ],
    "audience": "Job seekers and online task workers"
  },
  {
    "id": "SA-067",
    "slug": "circleglobalrecruitment-com",
    "title": "The recruiter who charges the candidate.",
    "short_title": "The flattering headhunter",
    "category": "Jobs",
    "technique": "Recruitment fee scam",
    "kind": "capture",
    "subject": "circleglobalrecruitment.com",
    "summary": "circleglobalrecruitment.com presents an international recruitment agency. Its contact comes as an unsolicited email from a Gmail address in the company's name, praising the recipient's career in detail and offering an unnamed senior role. The site's real destination is a payment page where the candidate types in an amount set by their \"representative\" for CV writing priced from $300 to $995.",
    "lesson": "Genuine recruiters are paid by the employer, never by the candidate. A flattering message that knows your CV but names no job, followed by a fee for rewriting your CV, is the pattern of a recruitment scam. Do not pay to be considered for a job.",
    "image": "circleglobalrecruitment-com.png",
    "image_source": "https://desenmascara.me/screens/52fa6ffe2fe5578a.png",
    "image_alt": "Capture of circleglobalrecruitment.com on 12 October 2026: a recruitment agency home page, 'Connecting the right people with the right roles'.",
    "claim": "A recruiter who found you a senior role",
    "counterclaim": "Why does the candidate pay?",
    "observations": [
      "The outreach email, received on 12 October 2026, came from a Gmail address in the company's name, not from the site's own domain. It summarised the recipient's public professional profile and named no employer and no position.",
      "The site's payment page reads: \"Please enter the exact payment amount provided by your Circle Global Recruitment representative.\"",
      "Services offered to candidates on that page: New Resume Writing $995; Resume Rewrite $300, $500 or $700; Cover Letter $300. Payments go through Paystack, a Nigerian payment gateway, and the currencies include the Nigerian naira.",
      "The refund policy states that fees are non-refundable once the \"service\" has started.",
      "The site names no company, registration number or address. The domain was about 100 days old when analysed."
    ],
    "source_summary": "Desenmascara publishes circleglobalrecruitment.com as Fraudulent after a manual review on 12 October 2026, with verbatim fragments of the payment and refund pages as public evidence. Follow the report for the full record and any later correction.",
    "limits": "This case documents the site's own pages and one unsolicited message; it does not prove customer losses or identify the operator. The Gmail address is not published on the site, so the link between the message and the domain rests on the company name and on the site's payment page relying on a \"representative\" who contacts candidates. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-12",
    "checked_at": "2026-10-12",
    "assessment": "Fraudulent · manual review",
    "assessment_source": "desenmascara.me · human review with verbatim site evidence",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report, archived capture and manual review with verbatim evidence",
        "url": "https://desenmascara.me/analisis/8178434e-d1df-4d98-98e8-1e24999ac3c4"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record (registered through NameCheap, Inc.).",
        "url": "https://lookup.icann.org/en/lookup?name=circleglobalrecruitment.com"
      }
    ],
    "audience": "Job seekers and professionals contacted by recruiters"
  },
  {
    "id": "SA-068",
    "slug": "dipb-gov-org",
    "title": "Daily earnings that never leave the dashboard.",
    "short_title": "The earnings dashboard",
    "category": "Jobs",
    "technique": "Advance-fee request",
    "kind": "capture",
    "subject": "dipb-gov.org",
    "summary": "dipb-gov.org is flagged by a financial regulator. Desenmascara publishes it as fraudulent (100/100) on that attribution, not as its own finding (captured on 2026-10-12).",
    "lesson": "A number on a dashboard does not prove that withdrawable earnings exist. Do not send money to release supposed wages.",
    "image": "dipb-gov-org.png",
    "image_source": "https://desenmascara.me/screens/db1419b49dc85f99.png",
    "image_alt": "Archived capture of dipb-gov.org, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "A displayed balance is not proof of withdrawable earnings",
    "observations": [
      "The source report records: official warning from Securities and Exchange Commission (United States of America) naming Department of Interagency Protection Bureau."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for dipb-gov.org, based on attributed financial regulator warning. The verdict is the third-party listing's, reported with attribution, not an independent finding. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-12",
    "checked_at": "2026-10-13",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · attributed financial regulator warning",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: attributed financial regulator warning",
        "url": "https://desenmascara.me/analisis/9f0dcbd4-1205-41ee-9c69-49e7bb29ccd5"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-03-12 through Stichting Registrar of Last Resort Foundation.",
        "url": "https://lookup.icann.org/en/lookup?name=dipb-gov.org"
      }
    ],
    "audience": "Job seekers and online task workers"
  },
  {
    "id": "SA-069",
    "slug": "bgwealthsharing-com",
    "title": "Big returns. No verifiable firm behind them.",
    "short_title": "The investment offer",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "bgwealthsharing.com",
    "summary": "bgwealthsharing.com is flagged by a financial regulator. Desenmascara publishes it as fraudulent (100/100) on that attribution, not as its own finding (captured on 2026-10-12).",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "bgwealthsharing-com.png",
    "image_source": "https://desenmascara.me/screens/e33a0e2fabec0a69.png",
    "image_alt": "Archived capture of bgwealthsharing.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: official warning from Ontario Securities Commission (Ontario) naming BG Wealth Sharing Ltd. (DSJ Exchange)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for bgwealthsharing.com, based on attributed financial regulator warning. The verdict is the third-party listing's, reported with attribution, not an independent finding. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-12",
    "checked_at": "2026-10-13",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · attributed financial regulator warning",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: attributed financial regulator warning",
        "url": "https://desenmascara.me/analisis/990c6f19-e9aa-4e62-88d1-5dfc12ae800b"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2025-01-14 through GoDaddy.com, LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=bgwealthsharing.com"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-070",
    "slug": "maygroupsolution-com",
    "title": "A job that asks you to pay in.",
    "short_title": "The task platform",
    "category": "Jobs",
    "technique": "Advance-fee request",
    "kind": "capture",
    "subject": "maygroupsolution.com",
    "summary": "maygroupsolution.com is flagged by a financial regulator. Desenmascara publishes it as fraudulent (100/100) on that attribution, not as its own finding (captured on 2026-10-13).",
    "lesson": "A number on a dashboard does not prove that withdrawable earnings exist. Do not send money to release supposed wages.",
    "image": "maygroupsolution-com.png",
    "image_source": "https://desenmascara.me/screens/3b5590a04f3c6571.png",
    "image_alt": "Archived capture of maygroupsolution.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "A displayed balance is not proof of withdrawable earnings",
    "observations": [
      "The source report records: official warning from Securities and Exchange Commission (United States of America) naming May Capital Group."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for maygroupsolution.com, based on attributed financial regulator warning. The verdict is the third-party listing's, reported with attribution, not an independent finding. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-13",
    "checked_at": "2026-10-13",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · attributed financial regulator warning",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: attributed financial regulator warning",
        "url": "https://desenmascara.me/analisis/46e32bbe-a8eb-443b-a4e7-ffce061fd3d7"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2023-01-26 through NameCheap, Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=maygroupsolution.com"
      }
    ],
    "audience": "Job seekers and online task workers"
  },
  {
    "id": "SA-071",
    "slug": "firagov-org",
    "title": "Automated profits, promised by nobody you can find.",
    "short_title": "The trading platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "firagov.org",
    "summary": "firagov.org is flagged by a financial regulator. Desenmascara publishes it as fraudulent (100/100) on that attribution, not as its own finding (captured on 2026-10-13).",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "firagov-org.png",
    "image_source": "https://desenmascara.me/screens/86ee1bd7a9f7242e.png",
    "image_alt": "Archived capture of firagov.org, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: official warning from Securities and Exchange Commission (United States of America) naming Fraud Investigation and Repatriation Authority."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for firagov.org, based on attributed financial regulator warning. The verdict is the third-party listing's, reported with attribution, not an independent finding. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-13",
    "checked_at": "2026-10-13",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · attributed financial regulator warning",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: attributed financial regulator warning",
        "url": "https://desenmascara.me/analisis/05b6c98b-15e9-4818-906b-3e1467930987"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-03-12 through Stichting Registrar of Last Resort Foundation.",
        "url": "https://lookup.icann.org/en/lookup?name=firagov.org"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-072",
    "slug": "teslaspacefinanceex-com",
    "title": "Big returns. No verifiable firm behind them.",
    "short_title": "The investment offer",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "teslaspacefinanceex.com",
    "summary": "teslaspacefinanceex.com presented itself as an investment or trading platform. Desenmascara rated it fraudulent (100/100) after AI-assisted analysis.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "teslaspacefinanceex-com.png",
    "image_source": "https://desenmascara.me/screens/2a2d72c82b0ba760.png",
    "image_alt": "Archived capture of teslaspacefinanceex.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 105 of 165 domains we have analysed are flagged (64%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for teslaspacefinanceex.com, based on AI-assisted analysis. Its analysis says: “The site presents itself as a financial services platform claiming to offer investment opportunities, but it is only 2 days old, which is a significant risk signal.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-14",
    "checked_at": "2026-10-14",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/59158f6e-ddb7-444b-92c2-ec424c6273cc"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-073",
    "slug": "advancedstocksonline-com",
    "title": "A job that asks you to pay in.",
    "short_title": "The task platform",
    "category": "Jobs",
    "technique": "Advance-fee request",
    "kind": "capture",
    "subject": "advancedstocksonline.com",
    "summary": "advancedstocksonline.com is flagged by a financial regulator. Desenmascara publishes it as fraudulent (100/100) on that attribution, not as its own finding (captured on 2026-10-14).",
    "lesson": "A number on a dashboard does not prove that withdrawable earnings exist. Do not send money to release supposed wages.",
    "image": "advancedstocksonline-com.png",
    "image_source": "https://desenmascara.me/screens/573bd3c7821365c4.png",
    "image_alt": "Archived capture of advancedstocksonline.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "A displayed balance is not proof of withdrawable earnings",
    "observations": [
      "The source report records: official warning from Financial Conduct Authority (United Kingdom) naming Advanced Stocks."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for advancedstocksonline.com, based on attributed financial regulator warning. The verdict is the third-party listing's, reported with attribution, not an independent finding. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-10-14",
    "checked_at": "2026-10-14",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · attributed financial regulator warning",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: attributed financial regulator warning",
        "url": "https://desenmascara.me/analisis/405aaf88-8b2e-4c7f-b93f-06bd18236a30"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2025-10-30 through TUCOWS.COM, CO..",
        "url": "https://lookup.icann.org/en/lookup?name=advancedstocksonline.com"
      }
    ],
    "audience": "Job seekers and online task workers"
  },
  {
    "id": "SA-074",
    "slug": "en-html-org-dead-domain-link-harvesting",
    "title": "A dead website's name. Someone else's business behind it.",
    "short_title": "The dead-domain link harvest",
    "category": "Impersonation",
    "technique": "Dead-domain owner impersonation",
    "kind": "incident",
    "audience": "Bloggers, librarians, Wikipedia editors and anyone who maintains old web pages with links",
    "subject": "en-html.org",
    "summary": "Emails written as if from the owners of defunct websites ask site administrators to swap old links for \"mirror\" copies on en-html.org. The copies are named after closed charities, archives and local history projects, and now redirect to commercial hotel sites.",
    "lesson": "A request to update an old link is not proof that it comes from the original owner. Check the new address before changing anything. If the original site is gone, link to an archive.org copy instead of a \"mirror\" offered by a stranger.",
    "claim": "We are the owners of the site you link to",
    "counterclaim": "Why does the new link end on a hotel website?",
    "observations": [
      "On 9 October 2026 a site administrator reported receiving emails from people posing as the legitimate owners of expired domains he had linked to, asking him to point those links to copies hosted on en-html.org.",
      "On 14 October 2026 the en-html.org home page showed \"Under Maintenance\" and linked to 23 subdomains named after defunct organisations, such as sharksavers, minneapolishistorical, ancient-egypt and fairmountpark.",
      "On the same day sharksavers.en-html.org answered with a permanent redirect (HTTP 301) to a page on beachhotel.net titled \"Shark Savers: Protecting the Oceans, One Shark at a Time | Beachhotel.net\", and minneapolishistorical.en-html.org redirected to a page on hotelsdowntown.info.",
      "en-html.org was registered on 28 April 2025 through Spaceship, Inc."
    ],
    "source_summary": "Russell Coker documented the emails and the en-html.org mirrors on his blog on 9 October 2026 and recommends replacing such links with archive.org copies. The redirects to hotel websites were observed by the Digital Fraud Observatory on 14 October 2026.",
    "limits": "The aim of building search ranking from old links is the source's inference; it is not confirmed by the operator. This case does not show that anyone lost money or that the hotel sites commissioned the scheme. The redirects can change at any time; they are described as they stood on 14 October 2026.",
    "analysis_date": "2026-10-09",
    "checked_at": "2026-10-14",
    "assessment": "Deceptive practice · independent report and direct observation",
    "assessment_source": "Russell Coker's blog; Digital Fraud Observatory",
    "sources": [
      {
        "name": "Russell Coker's blog (etbe)",
        "short": "etbe",
        "role": "Original report of the emails and the en-html.org mirrors · 9 October 2026",
        "url": "https://etbe.coker.com.au/2026/10/09/en-html-org-scam-site/"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record (registered through Spaceship, Inc.).",
        "url": "https://lookup.icann.org/en/lookup?name=en-html.org"
      }
    ],
    "pathway": {
      "heading": "How an old link becomes someone else's traffic",
      "intro": "Each step looks like a helpful correction. The control point is checking where the new link really ends before you change it.",
      "steps": [
        {
          "label": "REQUEST",
          "title": "\"We own the site you link to\"",
          "text": "An email claims to come from the owners of a website that has closed, and offers a \"mirror\" copy."
        },
        {
          "label": "VERIFY",
          "title": "Open the new link first",
          "text": "See where it really ends. If the original site is gone, link to an archive.org copy instead.",
          "warning": true
        },
        {
          "label": "REDIRECT",
          "title": "The link ends elsewhere",
          "text": "The \"mirror\" redirects to an unrelated commercial site, which inherits the trust of your old link."
        }
      ],
      "caption": "Documented from a public report and from the redirects observed on 14 October 2026. No live page from these sites is embedded here."
    }
  }
]