[
  {
    "id": "SA-004",
    "slug": "insurance-clone",
    "title": "A regulatory badge. A very different reality.",
    "short_title": "The insurance clone",
    "category": "Insurance",
    "technique": "Borrowed authority",
    "kind": "capture",
    "subject": "speedysure.co.uk",
    "summary": "An insurance site claims FCA regulation. The regulator identifies it as a clone firm.",
    "lesson": "Verify a regulatory claim with the regulator, using contact details from its official register.",
    "image": "insurance-clone.png",
    "image_source": "https://desenmascara.me/screens/d546934417842385.png",
    "image_alt": "Archived SpeedySure website offering car insurance from £4.50 an hour and claiming FCA regulation.",
    "claim": "FCA Regulated",
    "counterclaim": "Clone of an authorised firm",
    "observations": [
      "A prominent badge claims FCA regulation.",
      "A low hourly price, customer count and instant-quote buttons encourage registration.",
      "The capture presents the service as an established insurance provider."
    ],
    "source_summary": "The FCA names SpeedySure and speedysure.co.uk in a clone-firm warning. Desenmascara separately records a Suspicious assessment of 60/100 in report #11454.",
    "limits": "The image is a historical capture; its exact capture date is not established here. The source assessments are attributed separately. The screenshot does not establish AI use or customer losses. The genuine firm named by the FCA is separate from the clone.",
    "analysis_date": "2026-09-13",
    "checked_at": "2026-09-14",
    "assessment": "Suspicious · 60/100",
    "assessment_source": "desenmascara.me",
    "sources": [
      {
        "name": "Financial Conduct Authority",
        "short": "FCA",
        "role": "Independent clone-firm warning · 2 February 2026",
        "url": "https://www.fca.org.uk/news/warnings/speedysure-clone-fca-authorised-firm"
      },
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report #11454 and archived capture",
        "url": "https://desenmascara.me/analisis/60ffed47-2000-40f5-add7-6afa08f66085"
      }
    ],
    "audience": "Consumers buying insurance online"
  },
  {
    "id": "SA-005",
    "slug": "logistics-company-facade",
    "title": "A global operation. An identity still to verify.",
    "short_title": "The logistics-company facade",
    "category": "Transport",
    "technique": "Manufactured credibility",
    "kind": "capture",
    "subject": "folonicalogistics.com",
    "summary": "A cargo-port image, certification claim and parcel tracker present the appearance of an established carrier.",
    "lesson": "A transport website does not establish that a carrier exists. Verify the company identity and any certification through independent records before entrusting it with money or goods.",
    "image": "logistics-company-facade.png",
    "image_source": "https://desenmascara.me/screens/7057c6989c40fc48.png",
    "image_alt": "Archived Folanica-branded logistics page with container ships, port cranes, a certification claim and yellow Track Parcel buttons.",
    "claim": "Certified intermodal logistics",
    "counterclaim": "Who certified this operator?",
    "observations": [
      "A large photograph of container ships and port cranes suggests an international shipping operation.",
      "A certification badge makes an authority claim without identifying a certifier in this captured view.",
      "Parcel-tracking buttons and service navigation make the page look operational; the image cannot show whether those services work."
    ],
    "source_summary": "Desenmascara report #152096 records a Fraudulent assessment of 95/100, attributed to a PhishDestroy DestroyList match. Its accompanying analysis says the operator’s legal identity could not be verified and flags a recently registered domain.",
    "limits": "This is a suspected ghost-company facade, not an independent finding that no registered company exists. The historical capture does not establish ownership of the pictured ships, a working tracking system, customer losses or a payment demand. Its capture date is unknown. The report also labels text as AI-generated, but that automated attribution is not proof of authorship. Shared hosting or a young domain alone does not prove fraud.",
    "analysis_date": "2026-08-20",
    "checked_at": "2026-09-14",
    "assessment": "Fraudulent · 95/100",
    "assessment_source": "desenmascara.me · attributed PhishDestroy feed match",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report #152096 and archived capture; cites PhishDestroy as the verdict source",
        "url": "https://desenmascara.me/analisis/a59f7ad1-cace-4ed1-98e6-6e27a7b78615"
      }
    ],
    "audience": "Customers, shippers and business counterparties"
  },
  {
    "id": "SA-002",
    "slug": "celebrity-casino",
    "title": "A famous face. An unverified promise.",
    "short_title": "The celebrity casino",
    "category": "Crypto",
    "technique": "Celebrity impersonation",
    "kind": "capture",
    "subject": "Sanewex · domain partially masked in source",
    "summary": "Celebrity imagery and supposed official partnerships make a crypto casino look credible.",
    "lesson": "A famous face or familiar logo is a website’s claim. Check endorsements through the supposed partner’s own channels.",
    "image": "celebrity-casino.png",
    "image_source": "https://desenmascara.me/screens/f667d92e6e6f9130.png",
    "image_alt": "Archived Sanewex casino page displaying Elon Musk and X and SpaceX partnership claims.",
    "claim": "Official partner",
    "counterclaim": "Endorsement not verified",
    "observations": [
      "Elon Musk’s image appears beside a claim that he backs the casino.",
      "X and SpaceX branding is labeled as an official partnership.",
      "A bonus invitation sits alongside large player and payout figures."
    ],
    "source_summary": "Desenmascara classifies the page as a crypto gambling scam involving celebrity impersonation. Its rationale cites unverified partnership claims and no visible legitimate licensing information.",
    "limits": "This is Desenmascara’s recorded assessment, not a new investigation. The screenshot does not establish that AI created the page or images, or that the displayed payout figures are real. Follow the original report for context and corrections.",
    "analysis_date": "2026-08-21",
    "checked_at": "2026-09-14",
    "assessment": "Fraudulent · 81/100",
    "assessment_source": "desenmascara.me",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report #88469 and archived capture",
        "url": "https://desenmascara.me/analisis/090b5a46-d486-4065-8790-aa5b59f0b725?src=gallery"
      }
    ],
    "audience": "Crypto gamblers and retail investors"
  },
  {
    "id": "SA-001",
    "slug": "pay-to-get-paid",
    "title": "Your earnings are ready. First, send money.",
    "short_title": "The task-payment trap",
    "category": "Jobs",
    "technique": "Advance-fee request",
    "kind": "reconstruction",
    "subject": "Task scam pattern",
    "summary": "A supposed job shows earnings, then demands a deposit before you can withdraw them.",
    "lesson": "A number on a dashboard does not prove that withdrawable earnings exist. Do not send money to release supposed wages.",
    "message": "Great work! Your task balance is now €184. To withdraw it, top up your account with €60 to complete the final task set. The deposit will be returned with your earnings.",
    "claim": "€184 ready to withdraw",
    "counterclaim": "€60 deposit requested first",
    "observations": [
      "An apparent job offers commissions for simple online tasks.",
      "A displayed balance makes the earnings feel real.",
      "A separate payment is demanded before those supposed earnings can be withdrawn."
    ],
    "source_summary": "FTC guidance describes task scams in which an online platform displays apparent commissions, then asks the person to deposit their own money. The message here is an educational reconstruction of that pattern.",
    "limits": "The wording and amounts are invented. This is not a victim’s message or an accusation against a named business. A legitimate payout minimum is different from asking someone to send a separate deposit. AI involvement is not established.",
    "analysis_date": null,
    "checked_at": "2026-09-14",
    "assessment": "Documented pattern · fictional message",
    "assessment_source": "FTC guidance",
    "sources": [
      {
        "name": "Federal Trade Commission",
        "short": "FTC",
        "role": "Consumer advisory documenting task scams",
        "url": "https://consumer.ftc.gov/consumer-alerts/2024/11/task-scams-create-illusion-making-money"
      },
      {
        "name": "Federal Trade Commission",
        "short": "FTC",
        "role": "Task-scam analysis and reporting context",
        "url": "https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2024/12/paying-get-paid-gamified-job-scams-drive-record-losses"
      }
    ],
    "audience": "Job seekers and online task workers"
  },
  {
    "id": "SA-003",
    "slug": "discount-store",
    "title": "A big discount is a reason to check.",
    "short_title": "The discount storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "alwaysondeals.com",
    "summary": "An ordinary-looking shop promotes substantial discounts. The source flags a fake-store risk.",
    "lesson": "Check who operates a shop before trusting its sale. A discount alone proves neither fraud nor legitimacy.",
    "image": "discount-store.png",
    "image_source": "https://desenmascara.me/screens/d511479ddacafb4a.png",
    "image_alt": "Archived ALWAYS storefront with a Spanish sales banner and discounts of up to 75–80%.",
    "claim": "Large discounts and daily offers",
    "counterclaim": "Seller legitimacy needs checking",
    "observations": [
      "A Spanish storefront advertises large discounts and daily offers.",
      "Cart and account controls make the page look like a conventional shop.",
      "The screenshot does not identify who ultimately receives a buyer’s payment."
    ],
    "source_summary": "Desenmascara classifies it as a fake store, citing unusually high discounts, unclear brand legitimacy and hosting associations.",
    "limits": "Shared hosting is not proof of common ownership or fraud. The screenshot cannot establish non-delivery, stolen payments or AI-generated content. The classification belongs to the source; this card adds no independent verdict.",
    "analysis_date": "2026-02-10",
    "checked_at": "2026-09-14",
    "assessment": "Fraudulent · 75/100",
    "assessment_source": "desenmascara.me",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report #11604 and archived capture",
        "url": "https://desenmascara.me/analisis/dbe93ad9-fb73-47ca-8d2d-71a20f232e07"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-006",
    "slug": "investment-platform",
    "title": "A trading dashboard. A promise built on urgency.",
    "short_title": "The investment platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "spakasprimetrade.com",
    "summary": "A trading platform presents crypto and CFD investing as an easy route to returns.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "investment-platform.png",
    "image_source": "https://desenmascara.me/screens/12284042129701e8.png",
    "image_alt": "Archived Spakas Prime Trade investment platform presenting crypto and CFD trading claims.",
    "claim": "Professional trading platform",
    "counterclaim": "Investment firm and licensing need independent verification",
    "observations": [
      "The page presents a polished trading service with crypto and investment language.",
      "A young domain and unclear corporate identity increase the need for independent checks.",
      "The screenshot cannot establish whether funds were accepted or returned."
    ],
    "source_summary": "Desenmascara records a Fraudulent assessment for spakasprimetrade.com. The assessment describes a CFD trading platform using bitcoin and crypto language, a young domain and an unclear registrar identity, and labels the pattern investment fraud.",
    "limits": "This is a dated capture and an attributed source assessment, not a new investigation by this project. The image does not prove customer losses, the identity of an operator or that every crypto investment offer is fraudulent. Check current regulator records and the original report for updates.",
    "analysis_date": "2026-09-14",
    "checked_at": "2026-09-14",
    "assessment": "Fraudulent · source assessment",
    "assessment_source": "desenmascara.me",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture",
        "url": "https://desenmascara.me/analisis/549ed147-9c7e-429c-977f-69b31f8e0eba"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-007",
    "slug": "revolut-government-request-impersonation",
    "title": "A lawful-looking request. A disclosure to the wrong party.",
    "short_title": "The Revolut request impersonation",
    "category": "Financial data",
    "technique": "Government-request impersonation",
    "kind": "incident",
    "audience": "Banks, fintechs, legal and compliance teams; affected customers as data subjects",
    "subject": "Revolut customer-data disclosure after fraudulent government-domain requests",
    "summary": "Revolut confirmed that sensitive customer data was disclosed after fraudulent information requests were sent from a legitimate government-agency email domain.",
    "lesson": "For regulated firms, a trusted domain is not enough. Sensitive data requests need independent requester verification, authority checks and escalation paths before records leave the institution.",
    "claim": "Official information request",
    "counterclaim": "Requester authority must be independently verified",
    "observations": [
      "The reported attack targeted a compliance workflow rather than a public scam landing page.",
      "Revolut told TechCrunch the requests came from a legitimate government-agency email domain and were fraudulent.",
      "Reportedly exposed data included identity and contact details, identity-document copies, and possibly selfies, statements and transaction histories.",
      "Revolut said its systems and customer funds were unaffected, while affected customers were contacted directly."
    ],
    "source_summary": "TechCrunch reported on 12 September 2026 that Revolut confirmed a limited number of customers were impacted after fraudulent information requests were sent from a legitimate government-agency email domain. The Block separately reported that the incident involved KYC and account data, with possible Bitcoin transaction history exposure. The Financial Times later reported that nearly 700 customers were affected and that the UK Information Commissioner's Office had opened an investigation.",
    "limits": "This case is based on public reporting and Revolut statements quoted by those outlets. The government agency, exact request documents, affected markets and final regulator findings were not publicly established in these sources. The incident should not be described as customer funds being stolen or Revolut's core systems being compromised unless later evidence supports that.",
    "analysis_date": "2026-09-12",
    "checked_at": "2026-09-15",
    "assessment": "Confirmed data exposure · public reporting",
    "assessment_source": "TechCrunch, The Block and Financial Times",
    "sources": [
      {
        "name": "TechCrunch",
        "short": "TechCrunch",
        "role": "Initial report with Revolut confirmation · 12 September 2026",
        "url": "https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/"
      },
      {
        "name": "The Block",
        "short": "The Block",
        "role": "Follow-up report on KYC and transaction data exposure · 12 September 2026",
        "url": "https://www.theblock.co/news/business/2026-09-12-revolut-says-customer-kyc-bitcoin-transaction-data-exposed-after-fake-request-from-govt-domain-414516"
      },
      {
        "name": "Financial Times",
        "short": "FT",
        "role": "Follow-up reporting on affected-customer count and ICO investigation · 15 September 2026",
        "url": "https://www.ft.com/content/e0fe28a8-bc8c-460d-a7f2-972f725c0d46"
      }
    ]
  },
  {
    "id": "SA-010",
    "slug": "nobletechglobalinvesting-com",
    "title": "Crypto earnings, on a site nobody stands behind.",
    "short_title": "The wallet lure",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "nobletechglobalinvesting.com",
    "summary": "Desenmascara flagged nobletechglobalinvesting.com as fraudulent (100/100). The site presented itself as a crypto platform.",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "nobletechglobalinvesting-com.png",
    "image_source": "https://desenmascara.me/screens/d51b7f1befec67b1.png",
    "image_alt": "Archived capture of nobletechglobalinvesting.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "Promises returns that are unrealistic or guaranteed.",
      "Social media icons do not lead to real profiles.",
      "The domain was only 124 days old when analysed.",
      "The source report records: hosted on an address where 135 of 199 domains we have analysed are flagged (68%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for nobletechglobalinvesting.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-03",
    "checked_at": "2026-09-15",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/e7fa0168-0a43-4954-bbbd-876377aa5584"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-05-02 through Web4Africa Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=nobletechglobalinvesting.com"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-011",
    "slug": "global-freightltd-com",
    "title": "Cargo, tracking, a fleet: all claims, no carrier.",
    "short_title": "The freight company",
    "category": "Transport",
    "technique": "Manufactured credibility",
    "kind": "capture",
    "subject": "global-freightltd.com",
    "summary": "An archived look at global-freightltd.com, a logistics carrier assessed as fraudulent by Desenmascara (AI-assisted analysis, 99/100).",
    "lesson": "A transport website does not establish that a carrier exists. Verify the company identity before entrusting it with money or goods.",
    "image": "global-freightltd-com.png",
    "image_source": "https://desenmascara.me/screens/64507388f9c6be55.png",
    "image_alt": "Archived capture of global-freightltd.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Does this carrier exist outside its website?",
    "observations": [
      "Social media icons do not lead to real profiles.",
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 135 of 199 domains we have analysed are flagged (68%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 99/100 for global-freightltd.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-12",
    "checked_at": "2026-09-15",
    "assessment": "Fraudulent · 99/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/c4d5dc27-975f-499e-9d07-89f15b3c733b"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2025-11-02 through Global Domain Group LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=global-freightltd.com"
      }
    ],
    "audience": "Customers, shippers and business counterparties"
  },
  {
    "id": "SA-012",
    "slug": "cashclaimagilitybank-com",
    "title": "A bank website. No bank you can verify.",
    "short_title": "The banking portal",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "cashclaimagilitybank.com",
    "summary": "cashclaimagilitybank.com presented itself as a bank or financial service. Desenmascara rated it fraudulent (94/100) after AI-assisted analysis.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "cashclaimagilitybank-com.png",
    "image_source": "https://desenmascara.me/screens/163bc9bc546e0bd8.png",
    "image_alt": "Archived capture of cashclaimagilitybank.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 135 of 199 domains we have analysed are flagged (68%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 94/100 for cashclaimagilitybank.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-13",
    "checked_at": "2026-09-16",
    "assessment": "Fraudulent · 94/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/07e5b799-69e5-481d-998a-52ce57770b88"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-04-03 through Name SRS AB.",
        "url": "https://lookup.icann.org/en/lookup?name=cashclaimagilitybank.com"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-013",
    "slug": "repsolinvestt-shop",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "repsolinvestt.shop",
    "summary": "Captured on 2026-09-15: repsolinvestt.shop, an investment or trading platform that Desenmascara's AI-assisted analysis rated fraudulent at 93/100.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "repsolinvestt-shop.png",
    "image_source": "https://desenmascara.me/screens/80a38d2366cb9efa.png",
    "image_alt": "Archived capture of repsolinvestt.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 63 of 63 domains we have analysed are flagged (100%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for repsolinvestt.shop, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-15",
    "checked_at": "2026-09-16",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/83cba8a4-a20f-419c-b32d-cb1ecf1eb534"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-16).",
        "url": "https://www.virustotal.com/gui/domain/repsolinvestt.shop"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-014",
    "slug": "agosbitline-shop",
    "title": "Automated profits, promised by nobody you can find.",
    "short_title": "The trading platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "agosbitline.shop",
    "summary": "Desenmascara flagged agosbitline.shop as fraudulent (93/100). The site presented itself as an investment or trading platform.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "agosbitline-shop.png",
    "image_source": "https://desenmascara.me/screens/a82827fd9df6ad15.png",
    "image_alt": "Archived capture of agosbitline.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 72 of 73 domains we have analysed are flagged (99%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for agosbitline.shop, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-17",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/8f943989-787a-4834-95f3-2f02884678d2"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/agosbitline.shop"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-015",
    "slug": "oldmutualaiinvest-shop",
    "title": "Big returns. No verifiable firm behind them.",
    "short_title": "The investment offer",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "oldmutualaiinvest.shop",
    "summary": "An archived look at oldmutualaiinvest.shop, an investment or trading platform assessed as fraudulent by Desenmascara (AI-assisted analysis, 93/100).",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "oldmutualaiinvest-shop.png",
    "image_source": "https://desenmascara.me/screens/d46789ae95e9b1fc.png",
    "image_alt": "Archived capture of oldmutualaiinvest.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 72 of 73 domains we have analysed are flagged (99%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for oldmutualaiinvest.shop, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-17",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/14fba8af-ab43-467e-b88d-0a319ead8b1e"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/oldmutualaiinvest.shop"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-016",
    "slug": "chrysarinsoft-shop",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "chrysarinsoft.shop",
    "summary": "chrysarinsoft.shop presented itself as an investment or trading platform. Desenmascara rated it fraudulent (93/100) after AI-assisted analysis.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "chrysarinsoft-shop.png",
    "image_source": "https://desenmascara.me/screens/1c358b3d80342c6a.png",
    "image_alt": "Archived capture of chrysarinsoft.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 63 of 63 domains we have analysed are flagged (100%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for chrysarinsoft.shop, based on AI-assisted analysis. 15 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-17",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/e94c64eb-a399-47ff-81d9-f5194a765a2a"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 15 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/chrysarinsoft.shop"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-017",
    "slug": "clairezontbankcards-sbs",
    "title": "Automated profits, promised by nobody you can find.",
    "short_title": "The trading platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "clairezontbankcards.sbs",
    "summary": "Captured on 2026-09-16: clairezontbankcards.sbs, an investment or trading platform that Desenmascara's AI-assisted analysis rated fraudulent at 91/100.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "clairezontbankcards-sbs.png",
    "image_source": "https://desenmascara.me/screens/d0731c2b220c87b3.png",
    "image_alt": "Archived capture of clairezontbankcards.sbs, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 63 of 63 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for clairezontbankcards.sbs, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-17",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/14b80bac-06fe-4668-b264-fadd8854d79c"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/clairezontbankcards.sbs"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-02-17 through NETIM.",
        "url": "https://lookup.icann.org/en/lookup?name=clairezontbankcards.sbs"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-018",
    "slug": "prestigiomarketdex-shop",
    "title": "Big returns. No verifiable firm behind them.",
    "short_title": "The investment offer",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "prestigiomarketdex.shop",
    "summary": "Desenmascara flagged prestigiomarketdex.shop as fraudulent (93/100). The site presented itself as an investment or trading platform.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "prestigiomarketdex-shop.png",
    "image_source": "https://desenmascara.me/screens/f7166d0ba0d506a7.png",
    "image_alt": "Archived capture of prestigiomarketdex.shop, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "The source report records: hosted on an address where 72 of 73 domains we have analysed are flagged (99%).",
      "The source report records: suspicious TLD (.shop)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for prestigiomarketdex.shop, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-18",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/2a7bb098-6895-4e31-b02b-6a9233d86249"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-019",
    "slug": "paragonix-earn-tech-com",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "paragonix-earn-tech.com",
    "summary": "An archived look at paragonix-earn-tech.com, an investment or trading platform assessed as fraudulent by Desenmascara (AI-assisted analysis, 91/100).",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "paragonix-earn-tech-com.png",
    "image_source": "https://desenmascara.me/screens/df5200bad4519104.png",
    "image_alt": "Archived capture of paragonix-earn-tech.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 63 of 63 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for paragonix-earn-tech.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-15",
    "checked_at": "2026-09-18",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/23f74d45-5ded-466d-b702-1daf825f3bcf"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2025-11-12 through MainReg Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=paragonix-earn-tech.com"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-020",
    "slug": "meghnamoorsoftware-com",
    "title": "Automated profits, promised by nobody you can find.",
    "short_title": "The trading platform",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "meghnamoorsoftware.com",
    "summary": "meghnamoorsoftware.com presented itself as an investment or trading platform. Desenmascara rated it fraudulent (93/100) after AI-assisted analysis.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "meghnamoorsoftware-com.png",
    "image_source": "https://desenmascara.me/screens/f8d1e333899ce477.png",
    "image_alt": "Archived capture of meghnamoorsoftware.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 64 of 64 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for meghnamoorsoftware.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-15",
    "checked_at": "2026-09-19",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/54b4324f-8d14-49d4-8bb8-dd50d301900b"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-04-14 through MAT BAO CORPORATION.",
        "url": "https://lookup.icann.org/en/lookup?name=meghnamoorsoftware.com"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-021",
    "slug": "axel-fundriaplatform-com",
    "title": "A bank website. No bank you can verify.",
    "short_title": "The banking portal",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "axel-fundriaplatform.com",
    "summary": "Captured on 2026-09-16: axel-fundriaplatform.com, a bank or financial service that Desenmascara's AI-assisted analysis rated fraudulent at 91/100.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "axel-fundriaplatform-com.png",
    "image_source": "https://desenmascara.me/screens/962eadb172d0e1aa.png",
    "image_alt": "Archived capture of axel-fundriaplatform.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 64 of 64 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for axel-fundriaplatform.com, based on AI-assisted analysis. 15 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-19",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/6930b180-6d20-48ec-93d9-bdb936292537"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 15 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/axel-fundriaplatform.com"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2025-12-01 through MainReg Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=axel-fundriaplatform.com"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-022",
    "slug": "elitechain-finance-xyz",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "elitechain-finance.xyz",
    "summary": "Desenmascara flagged elitechain-finance.xyz as fraudulent (100/100). The site presented itself as an investment or trading platform.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "elitechain-finance-xyz.png",
    "image_source": "https://desenmascara.me/screens/f302711a97a27239.png",
    "image_alt": "Archived capture of elitechain-finance.xyz, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 51 of 56 domains we have analysed are flagged (91%).",
      "The source report records: domain registered 0 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for elitechain-finance.xyz, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-19",
    "checked_at": "2026-09-19",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/e54ad2c0-342f-4da7-b9d0-63f2d4537c8d"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-19 through Sav.com, LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=elitechain-finance.xyz"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-023",
    "slug": "instantrefundresolution-online",
    "title": "Cards and accounts, offered by no bank on record.",
    "short_title": "The bank that isn't",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "instantrefundresolution.online",
    "summary": "An archived look at instantrefundresolution.online, a bank or financial service assessed as fraudulent by Desenmascara (AI-assisted analysis, 100/100).",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "instantrefundresolution-online.png",
    "image_source": "https://desenmascara.me/screens/8c0d9c124c6dca38.png",
    "image_alt": "Archived capture of instantrefundresolution.online, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 51 of 56 domains we have analysed are flagged (91%).",
      "The source report records: domain registered 1 days ago.",
      "The source report records: suspicious TLD (.online)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for instantrefundresolution.online, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-19",
    "checked_at": "2026-09-19",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/b6d92da7-2bad-443f-9903-fd7d4facd7d9"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-18 through Spaceship, Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=instantrefundresolution.online"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-024",
    "slug": "expresscargo-xyz",
    "title": "A bank website. No bank you can verify.",
    "short_title": "The banking portal",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "expresscargo.xyz",
    "summary": "expresscargo.xyz presented itself as a bank or financial service. Desenmascara rated it fraudulent (93/100) after AI-assisted analysis.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "expresscargo-xyz.png",
    "image_source": "https://desenmascara.me/screens/d33f59ad141117a3.png",
    "image_alt": "Archived capture of expresscargo.xyz, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 103 of 134 domains we have analysed are flagged (77%).",
      "The source report records: suspicious TLD (.xyz)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 93/100 for expresscargo.xyz, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-20",
    "checked_at": "2026-09-20",
    "assessment": "Fraudulent · 93/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/dde0fe71-2079-45a6-a9a5-726cdb3b84f5"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-08-05 through TuringSign Inc. d/b/a Cosmotown.",
        "url": "https://lookup.icann.org/en/lookup?name=expresscargo.xyz"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-025",
    "slug": "aufstieg-gaintra-tech-com",
    "title": "A trading desk with no regulator on record.",
    "short_title": "The returns promise",
    "category": "Investment",
    "technique": "High-return promise",
    "kind": "capture",
    "subject": "aufstieg-gaintra-tech.com",
    "summary": "Captured on 2026-09-16: aufstieg-gaintra-tech.com, an investment or trading platform that Desenmascara's AI-assisted analysis rated fraudulent at 91/100.",
    "lesson": "Before investing, verify the firm in the relevant regulator register and treat guaranteed or effortless returns as a warning sign.",
    "image": "aufstieg-gaintra-tech-com.png",
    "image_source": "https://desenmascara.me/screens/13d3fb88df8708e0.png",
    "image_alt": "Archived capture of aufstieg-gaintra-tech.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this firm authorised to take your money?",
    "observations": [
      "No verifiable legal identity or mandatory legal information.",
      "The source report records: hosted on an address where 64 of 64 domains we have analysed are flagged (100%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 91/100 for aufstieg-gaintra-tech.com, based on AI-assisted analysis. 14 security vendors on VirusTotal independently flag the domain as malicious. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-16",
    "checked_at": "2026-09-20",
    "assessment": "Fraudulent · 91/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/3e12efbe-bbbe-46fb-9521-6029da1c2023"
      },
      {
        "name": "VirusTotal",
        "short": "VirusTotal",
        "role": "Independent corroboration: 14 security vendors flagged the domain as malicious (checked 2026-09-17).",
        "url": "https://www.virustotal.com/gui/domain/aufstieg-gaintra-tech.com"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-02-09 through MainReg Inc..",
        "url": "https://lookup.icann.org/en/lookup?name=aufstieg-gaintra-tech.com"
      }
    ],
    "audience": "Retail investors"
  },
  {
    "id": "SA-026",
    "slug": "259041-crypto-com",
    "title": "The coins are real. The platform is not verifiable.",
    "short_title": "The crypto platform",
    "category": "Crypto",
    "technique": "Crypto wallet or exchange lure",
    "kind": "capture",
    "subject": "259041-crypto.com",
    "summary": "Desenmascara flagged 259041-crypto.com as fraudulent (82/100). The site presented itself as a crypto platform.",
    "lesson": "Do not connect a wallet, send crypto or trust a token claim until you verify it through independent official channels.",
    "image": "259041-crypto-com.png",
    "image_source": "https://desenmascara.me/screens/b99fd09269902dd1.png",
    "image_alt": "Archived capture of 259041-crypto.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who controls the wallet you are asked to connect?",
    "observations": [
      "The source report records: domain registered 3 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 82/100 for 259041-crypto.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-20",
    "checked_at": "2026-09-21",
    "assessment": "Fraudulent · 82/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/096093b8-a614-44f1-9a91-3f5c73669d6a"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-17 through Dynadot Inc.",
        "url": "https://lookup.icann.org/en/lookup?name=259041-crypto.com"
      }
    ],
    "audience": "Crypto users and retail investors"
  },
  {
    "id": "SA-027",
    "slug": "remitmargin-com",
    "title": "A famous brand. A price too good to be true.",
    "short_title": "The brand storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "remitmargin.com",
    "summary": "An archived look at remitmargin.com, an online shop assessed as fraudulent by Desenmascara (heuristic analysis, 100/100).",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "remitmargin-com.png",
    "image_source": "https://desenmascara.me/screens/325f15a78901820a.png",
    "image_alt": "Archived capture of remitmargin.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 169 of 204 domains we have analysed are flagged (83%).",
      "The source report records: domain registered 14 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for remitmargin.com, based on heuristic analysis. Its analysis says: “What we found: Its server hosts 216 known fraudulent sites; Domain registered 14 days ago; Extreme discounts detected.” Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-22",
    "checked_at": "2026-09-22",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · heuristic analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: heuristic analysis",
        "url": "https://desenmascara.me/analisis/4d4b3a66-5b3c-48bd-aadb-7a709cd2fba9"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-08 through NAMECHEAP INC.",
        "url": "https://lookup.icann.org/en/lookup?name=remitmargin.com"
      }
    ],
    "audience": "Online shoppers"
  },
  {
    "id": "SA-028",
    "slug": "mt-bank-us",
    "title": "Online banking from a bank nobody licensed.",
    "short_title": "The card offer",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "mt-bank.us",
    "summary": "mt-bank.us presented itself as a bank or financial service. Desenmascara rated it fraudulent (85/100) after AI-assisted analysis.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "mt-bank-us.png",
    "image_source": "https://desenmascara.me/screens/a2d6f549289fd65e.png",
    "image_alt": "Archived capture of mt-bank.us, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: hosted on an address where 169 of 204 domains we have analysed are flagged (83%).",
      "The source report records: domain registered 0 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 85/100 for mt-bank.us, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-22",
    "checked_at": "2026-09-22",
    "assessment": "Fraudulent · 85/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/8e17b220-9146-40d0-ad4e-f94d5c3817cd"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-22 through PDR Ltd. d/b/a PublicDomainRegistry.com.",
        "url": "https://lookup.icann.org/en/lookup?name=mt-bank.us"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-029",
    "slug": "fx-alphapgims-online",
    "title": "Cards and accounts, offered by no bank on record.",
    "short_title": "The bank that isn't",
    "category": "Banking",
    "technique": "Financial-service facade",
    "kind": "capture",
    "subject": "fx-alphapgims.online",
    "summary": "Captured on 2026-09-22: fx-alphapgims.online, a bank or financial service that Desenmascara's AI-assisted analysis rated fraudulent at 100/100.",
    "lesson": "Use your bank's official app, domain or support channel before entering credentials or payment details, and check any new bank in the regulator's register.",
    "image": "fx-alphapgims-online.png",
    "image_source": "https://desenmascara.me/screens/513b5f55627e5a06.png",
    "image_alt": "Archived capture of fx-alphapgims.online, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Is this a bank any regulator has heard of?",
    "observations": [
      "The source report records: listed on DestroyList, the curated phishing feed maintained by PhishDestroy.",
      "The source report records: hosted on an address where 71 of 84 domains we have analysed are flagged (85%).",
      "The source report records: domain registered 0 days ago."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 100/100 for fx-alphapgims.online, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-22",
    "checked_at": "2026-09-23",
    "assessment": "Fraudulent · 100/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/209d982e-cb27-44de-88f2-62bf2fd5b511"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-09-22 through NameSilo, LLC.",
        "url": "https://lookup.icann.org/en/lookup?name=fx-alphapgims.online"
      }
    ],
    "audience": "Bank customers and payment users"
  },
  {
    "id": "SA-030",
    "slug": "flavoradeextractsshop-com",
    "title": "A famous brand. A price too good to be true.",
    "short_title": "The brand storefront",
    "category": "Shopping",
    "technique": "Deceptive storefront",
    "kind": "capture",
    "subject": "flavoradeextractsshop.com",
    "summary": "Desenmascara flagged flavoradeextractsshop.com as fraudulent (96/100). The site presented itself as an online shop.",
    "lesson": "Check who operates a shop before trusting its sale. A famous brand and a deep discount prove nothing about who takes your money.",
    "image": "flavoradeextractsshop-com.png",
    "image_source": "https://desenmascara.me/screens/ea8c5ee51835bbfa.png",
    "image_alt": "Archived capture of flavoradeextractsshop.com, a website assessed as fraudulent.",
    "claim": "An operating online service",
    "counterclaim": "Who operates this shop?",
    "observations": [
      "The source report records: hosted on an address where 32 of 46 domains we have analysed are flagged (70%)."
    ],
    "source_summary": "Desenmascara publishes a Fraudulent assessment of 96/100 for flavoradeextractsshop.com, based on AI-assisted analysis. Follow the report for the full rationale, evidence and any later correction.",
    "limits": "This case was added automatically from a dated, attributed source assessment; it is not an independent investigation by this project. The capture does not prove customer losses, operator identity or AI generation. Signals such as a young domain or shared hosting do not prove fraud on their own. If the source withdraws the verdict, this case is withdrawn too.",
    "analysis_date": "2026-09-23",
    "checked_at": "2026-09-23",
    "assessment": "Fraudulent · 96/100",
    "assessment_source": "desenmascara.me · AI-assisted analysis",
    "sources": [
      {
        "name": "desenmascara.me",
        "short": "Desenmascara",
        "role": "Public report and archived capture; verdict basis: AI-assisted analysis",
        "url": "https://desenmascara.me/analisis/9a4711e4-97ab-4697-804c-3421f4834152"
      },
      {
        "name": "ICANN Registration Data Lookup",
        "short": "ICANN",
        "role": "Public registration record. At analysis time it showed the domain registered on 2026-03-27 through ENOM, INC..",
        "url": "https://lookup.icann.org/en/lookup?name=flavoradeextractsshop.com"
      }
    ],
    "audience": "Online shoppers"
  }
]