Real examples — what one scam email turns into
Anonymized intake, straight through the pipeline.
Example 1 · Fake crypto exchange “apex-trade.io”
Inbound: “GUARANTEED 400% returns USDT” from broker@apex-trade.io, reply-to a Proton address, TRON wallet for deposits.
- Extracted: apex-trade.io, sending IP 203.0.113.7, TRON + BTC wallets, 2 phone numbers, SPF=fail evidence.
- Queued: registrar takedown letter to the registrar of record (RDAP-discovered), abuse@ to the hosting provider, Safe Browsing + URLhaus + PhishTank for the login page, Chainabuse for both wallets, FTC + IC3 filings.
- Outcome path: domain suspended in days; wallets flagged by exchanges; the campaign's conversion window collapses.
Example 2 · “Bank security team” phishing your mother
Inbound: spoofed bank display name, Gmail sender, link to a credential-harvest kit.
- Extracted: the real Gmail address behind the spoof, the harvest-kit URL on a compromised WordPress site.
- Queued: Google abuse form for the Gmail account, hosting provider abuse@ with the kit URL, registrar letter for the compromised domain, plus FTC filing.
- Bonus: a canary email planted in the “stolen data” she “surrendered” — if it resurfaces, we know which dump it went to.
Example 3 · Romance scam grooming
Inbound: “military engineer on an oil rig”, Telegram number, slow-build affection, investment pitch on day 12.
- Extracted: phone number, Telegram handle, the “exchange” domain pitched, wallet for the first “test deposit”.
- Bait: a decoy persona replies — confused, willing, slow — holding the scammer 9 hours across 40 messages. Zero real money ever moves.
- Queued: exchange abuse desk (wallet), national authority filing, PSA content for the target demographic.
These are illustrative composites of real campaign patterns — no member data is shown. Start your first case →